Vulnerability-Lookup

CVE-2026-13757 (GCVE-0-2026-13757)

Vulnerability from cvelistv5 – Published: 2026-06-29 18:44 – Updated: 2026-08-13 20:11

Title

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Summary

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-01 14:21 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

redhat

References

10 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:37469	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38342	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49667	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49668	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53371	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54387	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54760	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-13757	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2494556	issue-trackingx_refsource_REDHAT
https://github.com/advisories/GHSA-p2wm-69qx-x25w

Impacted products

16 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.26.4-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.26.4-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Discovery 2	Unaffected: 1786638573 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Discovery 2	Unaffected: 1786634825 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 0.26.2-1.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 0.26.4-1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1786433656 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1786435241 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1786533457 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1786533449 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1786435483 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1786533529 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-06-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-01T14:21:14.619672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-01T14:21:43.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.26.4-1.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.26.4-1.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.26.4-1.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-server-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786638573",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-ui-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786634825",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.26.2-1.2.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.26.4-1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786433656",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-kubernetes-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786435241",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/cds-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786533457",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/haproxy-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786533449",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/installer-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786435483",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1786533529",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "p11-kit",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-06-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T20:11:17.892Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:37469",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:37469"
        },
        {
          "name": "RHSA-2026:38342",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:38342"
        },
        {
          "name": "RHSA-2026:49667",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:49667"
        },
        {
          "name": "RHSA-2026:49668",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:49668"
        },
        {
          "name": "RHSA-2026:53371",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53371"
        },
        {
          "name": "RHSA-2026:54387",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "name": "RHSA-2026:54760",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-13757"
        },
        {
          "name": "RHBZ#2494556",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494556"
        },
        {
          "url": "https://github.com/advisories/GHSA-p2wm-69qx-x25w"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-23T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-23T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing",
      "workarounds": [
        {
          "lang": "en",
          "value": "This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/\u003cuid\u003e/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication.\n\nIf p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention.\n\nRed Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-674: Uncontrolled Recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-13757",
    "datePublished": "2026-06-29T18:44:24.583Z",
    "dateReserved": "2026-06-29T17:43:59.500Z",
    "dateUpdated": "2026-08-13T20:11:17.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-13757",
      "date": "2026-08-16",
      "epss": "0.00148",
      "percentile": "0.04504"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-03T01:04:13.000Z",
      "cve": "CVE-2026-13757",
      "id": "msrc_CVE-2026-13757",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-13757.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-13757\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-06-29T19:16:40.907\",\"lastModified\":\"2026-08-13T21:17:40.737\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"p11-kit\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:0.26.4-1.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"p11-kit\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\",\"cpe:/o:redhat:enterprise_linux:9::baseos\"],\"versions\":[{\"version\":\"0:0.26.4-1.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"p11-kit\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\",\"cpe:/o:redhat:enterprise_linux:9::baseos\"],\"versions\":[{\"version\":\"0:0.26.4-1.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Discovery 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"discovery/discovery-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:discovery:2::el9\"],\"versions\":[{\"version\":\"1786638573\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Discovery 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"discovery/discovery-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:discovery:2::el9\"],\"versions\":[{\"version\":\"1786634825\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"p11-kit-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"0.26.2-1.2.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"p11-kit-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"0.26.4-1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Insights proxy 1.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"insights-proxy/insights-proxy-container-rhel9\",\"cpes\":[\"cpe:/a:redhat:insights_proxy:1.5::el9\"],\"versions\":[{\"version\":\"1786433656\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/cds-kubernetes-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1786435241\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/cds-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1786533457\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/haproxy-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1786533449\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/installer-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1786435483\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/rhua-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1786533529\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"p11-kit\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"p11-kit\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"p11-kit\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-01T14:21:14.619672Z\",\"id\":\"CVE-2026-13757\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-674\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87DEB507-5B64-47D7-9A50-3B87FD1E571F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0\",\"versionEndIncluding\":\"4.22.1\",\"matchCriteriaId\":\"3F70390E-5DD6-42E4-AEA8-1C03337DDABC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:p11-kit_project:p11-kit:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC8CB498-F5D5-4AB6-B33E-404C80966280\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37469\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:38342\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:49667\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:49668\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53371\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54387\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54760\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-13757\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2494556\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/advisories/GHSA-p2wm-69qx-x25w\",\"source\":\"secalert@redhat.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T20:11:13+00:00",
      "cve": "CVE-2026-13757",
      "id": "CVE-2026-13757",
      "initial_release_date": "2026-06-23T00:00:00+00:00",
      "product_status:fixed": "150",
      "product_status:known_affected": "13",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13757.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13757\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-01T14:21:14.619672Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-01T14:21:38.241Z\"}}], \"cna\": {\"title\": \"P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.26.4-1.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"p11-kit\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/o:redhat:enterprise_linux:9::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.26.4-1.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"p11-kit\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/o:redhat:enterprise_linux:9::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.26.4-1.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"p11-kit\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786638573\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"discovery/discovery-server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786634825\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"discovery/discovery-ui-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.26.2-1.2.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"p11-kit-main\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.26.4-1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"p11-kit-main\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:insights_proxy:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Insights proxy 1.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786433656\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"insights-proxy/insights-proxy-container-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786435241\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/cds-kubernetes-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533457\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/cds-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533449\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/haproxy-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786435483\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/installer-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533529\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/rhua-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"p11-kit\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"p11-kit\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"p11-kit\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"rhcos\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-23T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-23T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-06-23T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:37469\", \"name\": \"RHSA-2026:37469\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:38342\", \"name\": \"RHSA-2026:38342\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:49667\", \"name\": \"RHSA-2026:49667\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:49668\", \"name\": \"RHSA-2026:49668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53371\", \"name\": \"RHSA-2026:53371\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54387\", \"name\": \"RHSA-2026:54387\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54760\", \"name\": \"RHSA-2026:54760\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-13757\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2494556\", \"name\": \"RHBZ#2494556\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://github.com/advisories/GHSA-p2wm-69qx-x25w\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/\u003cuid\u003e/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication.\\n\\nIf p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention.\\n\\nRed Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-674\", \"description\": \"Uncontrolled Recursion\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-08-13T20:11:17.892Z\"}, \"x_redhatCweChain\": \"CWE-674: Uncontrolled Recursion\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-13757\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T20:11:17.892Z\", \"dateReserved\": \"2026-06-29T17:43:59.500Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-06-29T18:44:24.583Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

RHSA-2026:54387

Vulnerability from csaf_redhat - Published: 2026-08-12 14:19 - Updated: 2026-08-16 13:29

Summary

Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update

Severity

Important

Notes

Topic: The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.

Details: Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-13757

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-14164

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-415 - Double Free

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-41989

A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-55653

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE-415 - Double Free

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64		—	Vendor Fix fix Workaround

Known not affected 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Workaround

Threats

Impact Moderate

CVE-2026-55654

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64		—	Vendor Fix fix
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64		—	Vendor Fix fix

Known not affected 3 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64		—
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64		—
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64		—

Threats

Impact Low

CVE-2026-55655

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

5.0 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64		—	Vendor Fix fix Workaround

Known not affected 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Workaround

Threats

Impact Moderate

CVE-2026-55693

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-57455

A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-57456

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-59856

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-59858

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-59996

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the `scp` command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to data integrity issues or, in some cases, unauthorized access to sensitive information if files are stored in an exposed location.

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64		—	Vendor Fix fix Workaround

Known not affected 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Workaround

Threats

Impact Moderate

CVE-2026-60002

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64		—	Vendor Fix fix Workaround

Known not affected 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64	—	Workaround
Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64	—	Workaround

Threats

Impact Important

References

92 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:54387	self
https://access.redhat.com/products/red-hat-update…	external
https://access.redhat.com/security/cve/CVE-2026-13757	external
https://access.redhat.com/security/cve/CVE-2026-14164	external
https://access.redhat.com/security/cve/CVE-2026-41989	external
https://access.redhat.com/security/cve/CVE-2026-55653	external
https://access.redhat.com/security/cve/CVE-2026-55654	external
https://access.redhat.com/security/cve/CVE-2026-55655	external
https://access.redhat.com/security/cve/CVE-2026-55693	external
https://access.redhat.com/security/cve/CVE-2026-57455	external
https://access.redhat.com/security/cve/CVE-2026-57456	external
https://access.redhat.com/security/cve/CVE-2026-59856	external
https://access.redhat.com/security/cve/CVE-2026-59858	external
https://access.redhat.com/security/cve/CVE-2026-59996	external
https://access.redhat.com/security/cve/CVE-2026-60002	external
https://access.redhat.com/security/updates/classi…	external
https://docs.redhat.com/en/documentation/red_hat_…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-13757	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494556	external
https://www.cve.org/CVERecord?id=CVE-2026-13757	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13757	external
https://github.com/advisories/GHSA-p2wm-69qx-x25w	external
https://access.redhat.com/security/cve/CVE-2026-14164	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493411	external
https://www.cve.org/CVERecord?id=CVE-2026-14164	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14164	external
https://github.com/libarchive/libarchive/issues/3069	external
https://github.com/libarchive/libarchive/pull/3071	external
https://access.redhat.com/security/cve/CVE-2026-41989	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461063	external
https://www.cve.org/CVERecord?id=CVE-2026-41989	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41989	external
https://dev.gnupg.org/T8211	external
https://lists.gnupg.org/pipermail/gnupg-announce/…	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-55653	self
https://bugzilla.redhat.com/show_bug.cgi?id=2462351	external
https://www.cve.org/CVERecord?id=CVE-2026-55653	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55653	external
https://access.redhat.com/security/cve/CVE-2026-55654	self
https://bugzilla.redhat.com/show_bug.cgi?id=2462493	external
https://www.cve.org/CVERecord?id=CVE-2026-55654	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55654	external
https://access.redhat.com/security/cve/CVE-2026-55655	self
https://bugzilla.redhat.com/show_bug.cgi?id=2462250	external
https://www.cve.org/CVERecord?id=CVE-2026-55655	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55655	external
https://access.redhat.com/security/cve/CVE-2026-55693	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492980	external
https://www.cve.org/CVERecord?id=CVE-2026-55693	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55693	external
https://github.com/vim/vim/commit/a80874d9b84a010…	external
https://github.com/vim/vim/releases/tag/v9.2.0653	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-57455	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492968	external
https://www.cve.org/CVERecord?id=CVE-2026-57455	external
https://nvd.nist.gov/vuln/detail/CVE-2026-57455	external
https://github.com/vim/vim/commit/497f931f85339d1…	external
https://github.com/vim/vim/releases/tag/v9.2.0698	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-57456	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492972	external
https://www.cve.org/CVERecord?id=CVE-2026-57456	external
https://nvd.nist.gov/vuln/detail/CVE-2026-57456	external
https://github.com/vim/vim/commit/cce141c42740f12…	external
https://github.com/vim/vim/releases/tag/v9.2.0699	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-59856	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498867	external
https://www.cve.org/CVERecord?id=CVE-2026-59856	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59856	external
https://github.com/vim/vim/commit/43afc581a37a357…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-59858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498868	external
https://www.cve.org/CVERecord?id=CVE-2026-59858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59858	external
https://github.com/vim/vim/commit/6b611b0d15603c5…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://access.redhat.com/security/cve/CVE-2026-59996	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497944	external
https://www.cve.org/CVERecord?id=CVE-2026-59996	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59996	external
https://marc.info/?l=openssh-unix-dev&m=178333966…	external
https://www.openssh.org/releasenotes.html#10.4p1	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-60002	self
https://bugzilla.redhat.com/show_bug.cgi?id=2497936	external
https://www.cve.org/CVERecord?id=CVE-2026-60002	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60002	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images.\nThis release updates to the latest version.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:54387",
        "url": "https://access.redhat.com/errata/RHSA-2026:54387"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/red-hat-update-infrastructure",
        "url": "https://access.redhat.com/products/red-hat-update-infrastructure"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13757",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13757"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-14164",
        "url": "https://access.redhat.com/security/cve/CVE-2026-14164"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41989",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41989"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55653",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55653"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55654",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55654"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55655",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55655"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55693",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57455",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57456",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59856",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59996",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59996"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-60002",
        "url": "https://access.redhat.com/security/cve/CVE-2026-60002"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5",
        "url": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54387.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update",
    "tracking": {
      "current_release_date": "2026-08-16T13:29:48+00:00",
      "generator": {
        "date": "2026-08-16T13:29:48+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:54387",
      "initial_release_date": "2026-08-12T14:19:15+00:00",
      "revision_history": [
        {
          "date": "2026-08-12T14:19:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-15T05:55:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-16T13:29:48+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Update Infrastructure 5",
                "product": {
                  "name": "Red Hat Update Infrastructure 5",
                  "product_id": "Red Hat Update Infrastructure 5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhui:5::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Update Infrastructure"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
                  "product_id": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cds-kubernetes-rhel9@sha256%3A50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/cds-kubernetes-rhel9\u0026tag=1786435241"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
                  "product_id": "registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cds-rhel9@sha256%3A65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/cds-rhel9\u0026tag=1786533457"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
                  "product_id": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/haproxy-rhel9@sha256%3Ac18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/haproxy-rhel9\u0026tag=1786533449"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
                  "product_id": "registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/installer-rhel9@sha256%3Acc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/installer-rhel9\u0026tag=1786435483"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64",
                  "product_id": "registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhua-rhel9@sha256%3A0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/rhua-rhel9\u0026tag=1786533529"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13757",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-06-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494556"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494556",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494556"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13757"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-p2wm-69qx-x25w",
          "url": "https://github.com/advisories/GHSA-p2wm-69qx-x25w"
        }
      ],
      "release_date": "2026-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/\u003cuid\u003e/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication.\n\nIf p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention.\n\nRed Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing"
    },
    {
      "cve": "CVE-2026-14164",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-06-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/issues/3069",
          "url": "https://github.com/libarchive/libarchive/issues/3069"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/3071",
          "url": "https://github.com/libarchive/libarchive/pull/3071"
        }
      ],
      "release_date": "2026-05-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
    },
    {
      "cve": "CVE-2026-41989",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-23T05:00:56.113348+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461063"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41989"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461063",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461063"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41989",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
        },
        {
          "category": "external",
          "summary": "https://dev.gnupg.org/T8211",
          "url": "https://dev.gnupg.org/T8211"
        },
        {
          "category": "external",
          "summary": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html",
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/21/1",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        }
      ],
      "release_date": "2026-04-23T04:30:26.124000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext"
    },
    {
      "cve": "CVE-2026-55653",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-04-26T18:54:39+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462351"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in OpenSSH affects clients operating in FIPS mode when negotiating Diffie-Hellman Group Exchange (DH-GEX) with a malicious SSH server. While it can lead to client process termination, resulting in a denial of service, the impact is limited to availability and does not result in broader system compromise. In order to exploit this vulnerability the attacker needs to trick the user to connect to an untrusted malicious server or compromise the server first. The availability impact is considered Low as the only impacted process is the single run of the SSH client trying to connect to the malicious server.\n\nThis vulnerability affects only the OpenSSH versions shipped with Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55653"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462351",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462351"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55653",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55653"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55653",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55653"
        }
      ],
      "release_date": "2026-06-22T23:17:43.088000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, OpenSSH clients operating in FIPS mode should avoid negotiating the `diffie-hellman-group-exchange-sha256` key exchange algorithm. This can be achieved by explicitly listing allowed key exchange algorithms in the client\u0027s SSH configuration file (e.g., `/etc/ssh/ssh_config` or `~/.ssh/config`), ensuring `diffie-hellman-group-exchange-sha256` is *not* included. For example, to use a subset of common algorithms, you might configure:\n\n```\nKexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\n```\n\n(Note: The above example `KexAlgorithms` list is illustrative and should be adjusted based on your environment\u0027s security requirements.)\n\nAdditionally, avoid using non-fatal client flows, such as `ssh-keyscan`, against untrusted SSH servers while FIPS mode is enabled. Changes to `ssh_config` will take effect for new SSH connections.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service"
    },
    {
      "cve": "CVE-2026-55654",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-04-26T19:17:42+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462493"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated Low. A heap out-of-bounds read in OpenSSH\u0027s GSSAPI authentication component can lead to a denial of service. Exploitation requires `GSSAPIAuthentication` to be explicitly enabled, which is not the default configuration in Red Hat products, and a Kerberos environment providing authenticated `auth-indicators`. The impact is limited to the availability of the SSH authentication process.\n\nThis vulnerability doesn\u0027t affect the upstream OpenSSH versions and is restricted to the versions as shipped with Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55654"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462493",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462493"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55654",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55654"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55654",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55654"
        }
      ],
      "release_date": "2026-06-22T23:18:14.750000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssh: Heap out-of-bounds read in Red Hat Enterprise Linux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination"
    },
    {
      "cve": "CVE-2026-55655",
      "cwe": {
        "id": "CWE-923",
        "name": "Improper Restriction of Communication Channel to Intended Endpoints"
      },
      "discovery_date": "2026-04-26T18:39:13+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462250"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate severity flaw. The OpenSSH client in Red Hat Enterprise Linux is vulnerable to a local man-in-the-middle attack on X11 forwarding connections. Exploitation requires an attacker to have local unprivileged access on the client system and for X11 forwarding to be explicitly enabled and in use, which is not a default configuration. The attack can compromise the confidentiality of forwarded X11 traffic. This vulnerability doesn\u0027t affect the upstream OpenSSH versions and is restricted to the versions as shipped with Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55655"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462250",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462250"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55655",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55655"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55655",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55655"
        }
      ],
      "release_date": "2026-06-22T23:22:11.127000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable X11 forwarding on OpenSSH clients when it is not required. This can be achieved by avoiding the use of `-X` or `-Y` options when invoking `ssh`, or by setting `ForwardX11 no` in the SSH client configuration file (`~/.ssh/config` or `/etc/ssh/ssh_config`). Disabling X11 forwarding will prevent the client from attempting to establish X11 connections, thereby removing the attack vector.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions"
    },
    {
      "cve": "CVE-2026-55693",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-25T16:02:21.870241+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Out-of-bounds Write in Spell File Word Count",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Vim\u0027s spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a malicious file, limiting its immediate exploitability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55693",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
          "url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0653",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
        }
      ],
      "release_date": "2026-06-25T15:34:33.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Out-of-bounds Write in Spell File Word Count"
    },
    {
      "cve": "CVE-2026-57455",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-25T16:01:18.343208+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492968"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492968",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57455",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        }
      ],
      "release_date": "2026-06-25T15:22:37.949000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()"
    },
    {
      "cve": "CVE-2026-57456",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-25T16:01:37.648886+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492972"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important. A vulnerability in Vim\u0027s Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492972",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57456",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        }
      ],
      "release_date": "2026-06-25T15:16:16.015000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion"
    },
    {
      "cve": "CVE-2026-59856",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:40.406872+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk.\"",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59856",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
          "url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
        }
      ],
      "release_date": "2026-07-09T22:39:01.803000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion"
    },
    {
      "cve": "CVE-2026-59858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:43.278752+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A command injection vulnerability in Vim\u0027s C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Vim\u0027s C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
          "url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
        }
      ],
      "release_date": "2026-07-09T22:37:52.789000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion"
    },
    {
      "cve": "CVE-2026-59996",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-08T01:02:02.730076+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497944"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the `scp` command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to data integrity issues or, in some cases, unauthorized access to sensitive information if files are stored in an exposed location.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Conditions for Exploitation: Exploitation requires specific user actions and conditions, as the vulnerability only triggers when a user explicitly initiates a file copy between two remote destinations using the scp command.\n\nImpact Limitations: The boundaries of the potential impact are highly contained. The flaw only results in unintended file placement within the parent directory of the target destination. It does not inherently lead to arbitrary code execution, denial of service, or privilege escalation, and any potential data exposure relies heavily on the existing permissions of the parent directory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59996"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497944",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497944"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59996",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59996"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59996",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59996"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:07:07.759000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid performing `scp` operations directly between two remote destinations. Instead, consider copying files from the first remote host to a local machine, and then from the local machine to the second remote host. Alternatively, use `sftp` or `rsync` for remote file transfers, as these utilities are not affected by this specific vulnerability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy"
    },
    {
      "cve": "CVE-2026-60002",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-07-08T01:01:33.808610+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497936"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497936",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497936"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-60002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:17:33.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-12T14:19:15+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54387"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:50b396a00e59ceebbce982e8758bdc12b84a479027f5f1f156d8fe7fd37450c4_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:65e3ccebf3adfb6eab0366fb07144dec5ac1ffac17ca969ec31a33496851a9bd_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:c18c0c874f539a50a51e36eefbac236e28837791c5465ce32f778ca4e994a0b3_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:cc0ad7b03c50a4a04058b17aa815c86b8ff06496b2b57db6dbea650415c7f362_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:0fac48c335f125b2db516fb4efacbedfb4524257c84d61eabaad754c5de56e7f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side"
    }
  ]
}

RHSA-2026:54760

Vulnerability from csaf_redhat - Published: 2026-08-13 19:46 - Updated: 2026-08-16 18:27

Summary

Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

Severity

Important

Notes

Topic: A Subscription Management tool for finding and reporting Red Hat product usage

Details: Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

CVE-2025-4330

A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata.

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Workaround

Threats

Impact Moderate

CVE-2026-6477

A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client's stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.

8.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Workaround

Threats

Impact Important

CVE-2026-8643

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.

8.0 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Workaround

Threats

Impact Important

CVE-2026-9595

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

CWE-346 - Origin Validation Error

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

CVE-2026-11940

A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Workaround

Threats

Impact Important

CVE-2026-13676

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

CVE-2026-13757

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-14164

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-415 - Double Free

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Workaround

Threats

Impact Moderate

CVE-2026-14257

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

CVE-2026-34993

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.

7.2 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Workaround

Threats

Impact Important

CVE-2026-41989

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-69152

A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

CVE-2026-69153

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

CVE-2026-69243

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before the entire body is received. This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources.

7.0 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—

Threats

Impact Moderate

CVE-2026-69244

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit this to trigger a Denial of Service (DoS) in the client application, making it unavailable.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Workaround

Threats

Impact Important

CVE-2026-73086

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-1241 - Use of Predictable Algorithm in Random Number Generator

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

CVE-2026-73088

A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

CVE-2026-73089

A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64		—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64		—	Workaround
Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64		—	Workaround

Threats

Impact Important

References

149 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:54760	self
https://access.redhat.com/security/cve/CVE-2025-4330	external
https://access.redhat.com/security/cve/CVE-2026-11940	external
https://access.redhat.com/security/cve/CVE-2026-13676	external
https://access.redhat.com/security/cve/CVE-2026-13757	external
https://access.redhat.com/security/cve/CVE-2026-14164	external
https://access.redhat.com/security/cve/CVE-2026-14257	external
https://access.redhat.com/security/cve/CVE-2026-34993	external
https://access.redhat.com/security/cve/CVE-2026-41989	external
https://access.redhat.com/security/cve/CVE-2026-6477	external
https://access.redhat.com/security/cve/CVE-2026-69152	external
https://access.redhat.com/security/cve/CVE-2026-69153	external
https://access.redhat.com/security/cve/CVE-2026-69243	external
https://access.redhat.com/security/cve/CVE-2026-69244	external
https://access.redhat.com/security/cve/CVE-2026-73086	external
https://access.redhat.com/security/cve/CVE-2026-73088	external
https://access.redhat.com/security/cve/CVE-2026-73089	external
https://access.redhat.com/security/cve/CVE-2026-8643	external
https://access.redhat.com/security/cve/CVE-2026-9595	external
https://access.redhat.com/security/updates/classi…	external
https://docs.redhat.com/en/documentation/subscrip…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-4330	self
https://bugzilla.redhat.com/show_bug.cgi?id=2370014	external
https://www.cve.org/CVERecord?id=CVE-2025-4330	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4330	external
https://gist.github.com/sethmlarson/52398e33eff26…	external
https://github.com/python/cpython/commit/3612d8f5…	external
https://github.com/python/cpython/commit/9e0ac76d…	external
https://github.com/python/cpython/issues/135034	external
https://github.com/python/cpython/pull/135037	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-6477	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477442	external
https://www.cve.org/CVERecord?id=CVE-2026-6477	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6477	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-8643	self
https://bugzilla.redhat.com/show_bug.cgi?id=2460927	external
https://www.cve.org/CVERecord?id=CVE-2026-8643	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8643	external
https://github.com/pypa/pip/commit/8eb178480bd1a2…	external
https://access.redhat.com/security/cve/CVE-2026-9595	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488934	external
https://www.cve.org/CVERecord?id=CVE-2026-9595	external
https://nvd.nist.gov/vuln/detail/CVE-2026-9595	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/facebook/create-react-app/pull/7444	external
https://github.com/vuejs/vue-cli/commit/72ba7505a…	external
https://github.com/webpack/webpack-dev-server/pull/4316	external
https://github.com/webpack/webpack-dev-server/sec…	external
https://access.redhat.com/security/cve/CVE-2026-11940	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491848	external
https://www.cve.org/CVERecord?id=CVE-2026-11940	external
https://nvd.nist.gov/vuln/detail/CVE-2026-11940	external
https://github.com/python/cpython/issues/151558	external
https://github.com/python/cpython/pull/151559	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-13676	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494197	external
https://www.cve.org/CVERecord?id=CVE-2026-13676	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13676	external
https://github.com/fastify/fast-uri/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-13757	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494556	external
https://www.cve.org/CVERecord?id=CVE-2026-13757	external
https://nvd.nist.gov/vuln/detail/CVE-2026-13757	external
https://github.com/advisories/GHSA-p2wm-69qx-x25w	external
https://access.redhat.com/security/cve/CVE-2026-14164	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493411	external
https://www.cve.org/CVERecord?id=CVE-2026-14164	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14164	external
https://github.com/libarchive/libarchive/issues/3069	external
https://github.com/libarchive/libarchive/pull/3071	external
https://access.redhat.com/security/cve/CVE-2026-14257	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506433	external
https://www.cve.org/CVERecord?id=CVE-2026-14257	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14257	external
https://github.com/juliangruber/brace-expansion	external
https://github.com/juliangruber/brace-expansion/c…	external
https://www.npmjs.com/package/brace-expansion	external
https://access.redhat.com/security/cve/CVE-2026-34993	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484099	external
https://www.cve.org/CVERecord?id=CVE-2026-34993	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34993	external
https://github.com/aio-libs/aiohttp/commit/dcf40f…	external
https://github.com/aio-libs/aiohttp/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-41989	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461063	external
https://www.cve.org/CVERecord?id=CVE-2026-41989	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41989	external
https://dev.gnupg.org/T8211	external
https://lists.gnupg.org/pipermail/gnupg-announce/…	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-69152	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510722	external
https://www.cve.org/CVERecord?id=CVE-2026-69152	external
https://nvd.nist.gov/vuln/detail/CVE-2026-69152	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/s…	external
https://access.redhat.com/security/cve/CVE-2026-69153	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510719	external
https://www.cve.org/CVERecord?id=CVE-2026-69153	external
https://nvd.nist.gov/vuln/detail/CVE-2026-69153	external
https://github.com/postcss/postcss/commit/7beca13…	external
https://github.com/postcss/postcss/releases/tag/8.5.19	external
https://github.com/postcss/postcss/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-69243	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510831	external
https://www.cve.org/CVERecord?id=CVE-2026-69243	external
https://nvd.nist.gov/vuln/detail/CVE-2026-69243	external
https://github.com/aio-libs/aiohttp/commit/6ae358…	external
https://github.com/aio-libs/aiohttp/pull/13017	external
https://github.com/aio-libs/aiohttp/releases/tag/…	external
https://github.com/aio-libs/aiohttp/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-69244	self
https://bugzilla.redhat.com/show_bug.cgi?id=2510825	external
https://www.cve.org/CVERecord?id=CVE-2026-69244	external
https://nvd.nist.gov/vuln/detail/CVE-2026-69244	external
https://github.com/aio-libs/aiohttp/commit/49f65d…	external
https://github.com/aio-libs/aiohttp/pull/13223	external
https://github.com/aio-libs/aiohttp/releases/tag/…	external
https://github.com/aio-libs/aiohttp/security/advi…	external
https://access.redhat.com/security/cve/CVE-2026-73086	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514175	external
https://www.cve.org/CVERecord?id=CVE-2026-73086	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73086	external
https://github.com/ai/nanoid/commit/7087969281cab…	external
https://github.com/ai/nanoid/commit/821dfed7b5db7…	external
https://github.com/ai/nanoid/commit/b0036ed60dc9f…	external
https://github.com/ai/nanoid/releases/tag/3.3.12	external
https://github.com/ai/nanoid/releases/tag/5.1.11	external
https://github.com/ai/nanoid/security/advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-73088	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514177	external
https://www.cve.org/CVERecord?id=CVE-2026-73088	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73088	external
https://github.com/browserslist/browserslist/comm…	external
https://github.com/browserslist/browserslist/rele…	external
https://github.com/browserslist/browserslist/secu…	external
https://access.redhat.com/security/cve/CVE-2026-73089	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514195	external
https://www.cve.org/CVERecord?id=CVE-2026-73089	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73089	external
https://github.com/browserslist/browserslist/comm…	external
https://github.com/browserslist/browserslist/secu…	external

Acknowledgments

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A Subscription Management tool for finding and reporting Red Hat product usage",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,\nidentifies, and reports environment data, or facts, such as the number of physical and virtual\nsystems on a network, their operating systems, and relevant configuration data stored within\nthem. Discovery also identifies and reports more detailed facts for some versions of key\nRed Hat packages and products that it finds in the network.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:54760",
        "url": "https://access.redhat.com/errata/RHSA-2026:54760"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-4330",
        "url": "https://access.redhat.com/security/cve/CVE-2025-4330"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11940",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11940"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13757",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13757"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-14164",
        "url": "https://access.redhat.com/security/cve/CVE-2026-14164"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-14257",
        "url": "https://access.redhat.com/security/cve/CVE-2026-14257"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34993",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34993"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41989",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41989"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6477",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6477"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69243",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69243"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69244",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69244"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73086",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73086"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73088",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73089",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-8643",
        "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9595",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9595"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery",
        "url": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54760.json"
      }
    ],
    "title": "Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage",
    "tracking": {
      "current_release_date": "2026-08-16T18:27:08+00:00",
      "generator": {
        "date": "2026-08-16T18:27:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:54760",
      "initial_release_date": "2026-08-13T19:46:27+00:00",
      "revision_history": [
        {
          "date": "2026-08-13T19:46:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-15T05:55:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-16T18:27:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Discovery 2",
                "product": {
                  "name": "Red Hat Discovery 2",
                  "product_id": "Red Hat Discovery 2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:discovery:2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Discovery"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
                "product": {
                  "name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
                  "product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/discovery-server-rhel9@sha256%3A43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1786638573"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
                "product": {
                  "name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
                  "product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/discovery-ui-rhel9@sha256%3A39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1786634825"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
                "product": {
                  "name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
                  "product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/discovery-server-rhel9@sha256%3A33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1786638573"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64",
                "product": {
                  "name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64",
                  "product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/discovery-ui-rhel9@sha256%3A8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1786634825"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64 as a component of Red Hat Discovery 2",
          "product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64"
        },
        "product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
        "relates_to_product_reference": "Red Hat Discovery 2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64 as a component of Red Hat Discovery 2",
          "product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        },
        "product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
        "relates_to_product_reference": "Red Hat Discovery 2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64 as a component of Red Hat Discovery 2",
          "product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64"
        },
        "product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
        "relates_to_product_reference": "Red Hat Discovery 2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64 as a component of Red Hat Discovery 2",
          "product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        },
        "product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64",
        "relates_to_product_reference": "Red Hat Discovery 2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-4330",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2025-06-03T14:01:00.653313+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2370014"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in CPython\u0027s tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter=\"data\" or filter=\"tar\" parameters. This issue leads to potentially overwriting or modifying system files and metadata.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cpython: python: Extraction filter bypass for linking outside extraction directory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The severity of this vulnerability was lowered due to the fact that successful exploitation requires the attacker to convince a privileged user or process to extract a malicious tar file. Since tar file extraction typically occurs in trusted contexts or with elevated privileges, the impact is reduced by the requirement of this access.\n\nVersions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as \u0027Not affected\u0027 as they just provide \"symlinks\" to the main python3 component, which provides the actual interpreter of the Python programming language.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-4330"
        },
        {
          "category": "external",
          "summary": "RHBZ#2370014",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-4330",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4330"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-4330",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4330"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f",
          "url": "https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a",
          "url": "https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a",
          "url": "https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/135034",
          "url": "https://github.com/python/cpython/issues/135034"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/135037",
          "url": "https://github.com/python/cpython/pull/135037"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"
        }
      ],
      "release_date": "2025-06-03T12:58:57.452000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cpython: python: Extraction filter bypass for linking outside extraction directory"
    },
    {
      "cve": "CVE-2026-6477",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-05-14T14:01:31.087667+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477442"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client\u0027s stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This IMPORTANT buffer overflow in PostgreSQL libpq allows a malicious server superuser to overwrite client stack memory via lo_* functions. Exploitation requires the victim to connect to a compromised or malicious server (UI:R). The scope is changed as the server attack affects the client system. Impact is high to confidentiality, integrity, and availability through potential client-side code execution. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6477"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477442",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477442"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6477",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6477"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477"
        },
        {
          "category": "external",
          "summary": "https://www.postgresql.org/support/security/CVE-2026-6477/",
          "url": "https://www.postgresql.org/support/security/CVE-2026-6477/"
        }
      ],
      "release_date": "2026-05-14T13:00:12.497000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-8643",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-04-22T23:09:35+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in pip\u0027s wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user\u0027s permissions, using `pip install` with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8643",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb",
          "url": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb"
        }
      ],
      "release_date": "2026-05-27T17:03:36.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite"
    },
    {
      "cve": "CVE-2026-9595",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-06-15T16:01:15.427658+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as \u0027/\u0027, and enables WebSocket (ws: true) forwarding, the development server\u0027s own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser\u0027s cookies and Origin header to the proxy target, bypassing the server\u0027s Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9595"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9595",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9595"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9595",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9595"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/facebook/create-react-app/pull/7444",
          "url": "https://github.com/facebook/create-react-app/pull/7444"
        },
        {
          "category": "external",
          "summary": "https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb",
          "url": "https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb"
        },
        {
          "category": "external",
          "summary": "https://github.com/webpack/webpack-dev-server/pull/4316",
          "url": "https://github.com/webpack/webpack-dev-server/pull/4316"
        },
        {
          "category": "external",
          "summary": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79",
          "url": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79"
        }
      ],
      "release_date": "2026-06-15T15:00:21.488000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid configuring `webpack-dev-server` with a broad proxy context (e.g., `/`) when WebSocket forwarding (`ws: true`) is enabled. Instead, define specific paths for the proxy context. Alternatively, disable WebSocket forwarding by omitting `ws: true` from the proxy entry if WebSocket functionality is not required for the proxy target. This configuration change may require restarting the `webpack-dev-server` instance to take effect.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration"
    },
    {
      "cve": "CVE-2026-11940",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-23T17:05:33.822236+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491848"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products that appear in dependency searches under names containing \"tarfile\" but that are not the CPython standard-library tarfile module are not affected by this flaw. Matches such as the Go packages under github.com/containers/image / go.podman.io/image (.../docker/tarfile and .../docker/internal/tarfile) and the Apache Camel artifacts (camel-tarfile, camel-quarkus-tarfile) are unrelated implementations in other languages and do not include the vulnerable CPython tarfile.extractall() filter logic. The separately packaged PyPI component backports-tarfile is also out of scope for this CVE as assigned: it is not the CPython stdlib module named in the advisory and this CVE tracks the interpreter-provided tarfile shipped in Red Hat python3* packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491848",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491848"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11940",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/151558",
          "url": "https://github.com/python/cpython/issues/151558"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/151559",
          "url": "https://github.com/python/cpython/pull/151559"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"
        }
      ],
      "release_date": "2026-06-23T16:04:17.321000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-13757",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-06-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494556"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494556",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494556"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13757"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-p2wm-69qx-x25w",
          "url": "https://github.com/advisories/GHSA-p2wm-69qx-x25w"
        }
      ],
      "release_date": "2026-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/\u003cuid\u003e/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication.\n\nIf p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention.\n\nRed Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing"
    },
    {
      "cve": "CVE-2026-14164",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-06-26T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/issues/3069",
          "url": "https://github.com/libarchive/libarchive/issues/3069"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/3071",
          "url": "https://github.com/libarchive/libarchive/pull/3071"
        }
      ],
      "release_date": "2026-05-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
    },
    {
      "cve": "CVE-2026-14257",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-23T14:01:26.376839+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the brace-expansion npm package. The expand() function limits the number of generated results but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the result count under the limit while making each result progressively longer, causing total memory consumption to grow until the Node.js process crashes with an uncatchable out-of-memory error. This affects any application that passes attacker-influenced strings to brace-expansion directly or transitively via minimatch or glob brace patterns.\n\nNote: In the majority of Red Hat products, brace-expansion is brought in as a transitive dependency of minimatch or glob and is not used at runtime. It is typically only invoked during build or development tooling and is not directly exposed to untrusted network input, reducing the practical exploitability of this flaw.\n\n```\n$ npm ls --omit=dev brace-expansion\nnpm@10.9.8 /usr/lib/node_modules/npm\n`-- minimatch@9.0.9\n  `-- brace-expansion@2.0.2\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14257",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion",
          "url": "https://github.com/juliangruber/brace-expansion"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
          "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-07-23T12:54:23.124000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Do not pass untrusted or user-controlled input to brace-expansion\u0027s expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion.\n\nWhere possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.\n\nAs an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
    },
    {
      "cve": "CVE-2026-34993",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-06-02T20:01:12.690409+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484099"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in AIOHTTP, a Python asynchronous HTTP framework, due to potential arbitrary code execution. The vulnerability arises when applications load untrusted input into the `CookieJar.load()` function. Exploitation requires an application to be configured to process attacker-controlled files, which is not a default or common scenario in most Red Hat product deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34993"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484099",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484099"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34993",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34993"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34993",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34993"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00",
          "url": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8",
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"
        }
      ],
      "release_date": "2026-06-02T18:29:15.847000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Applications using AIOHTTP that are configured to load untrusted files via the `CookieJar.load()` function should implement input sanitization prior to loading. This prevents the injection of malicious code.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()"
    },
    {
      "cve": "CVE-2026-41989",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-23T05:00:56.113348+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461063"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41989"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461063",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461063"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41989",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
        },
        {
          "category": "external",
          "summary": "https://dev.gnupg.org/T8211",
          "url": "https://dev.gnupg.org/T8211"
        },
        {
          "category": "external",
          "summary": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html",
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/21/1",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        }
      ],
      "release_date": "2026-04-23T04:30:26.124000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext"
    },
    {
      "cve": "CVE-2026-69152",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T18:01:13.566423+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that pass user-controlled input to the `expand()` function are vulnerable to this issue. This flaw can result in an excessive consumption of memory that eventually terminates the process or blocks the event loop, both causing a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        }
      ],
      "release_date": "2026-08-03T16:33:36.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not pass untrusted input to the expand() function.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "cve": "CVE-2026-69153",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-03T18:01:01.506065+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
          "url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
        }
      ],
      "release_date": "2026-08-03T16:56:25.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
    },
    {
      "cve": "CVE-2026-69243",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-08-03T22:02:56.444781+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510831"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before the entire body is received. This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69243"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510831",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510831"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69243",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69243"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69243",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69243"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98",
          "url": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/pull/13017",
          "url": "https://github.com/aio-libs/aiohttp/pull/13017"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2",
          "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v",
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"
        }
      ],
      "release_date": "2026-08-03T20:45:43.406000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade"
    },
    {
      "cve": "CVE-2026-69244",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-03T22:02:32.583060+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit this to trigger a Denial of Service (DoS) in the client application, making it unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important severity flaw in aiohttp that could lead to a denial of service in client applications. A remote, malicious HTTP server could send a specially crafted response, causing an out-of-bounds read in the aiohttp C response parser and resulting in the client application terminating unexpectedly.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69244"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69244",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69244"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69244",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69244"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d",
          "url": "https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/pull/13223",
          "url": "https://github.com/aio-libs/aiohttp/pull/13223"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3",
          "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273",
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"
        }
      ],
      "release_date": "2026-08-03T20:50:59.538000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses"
    },
    {
      "cve": "CVE-2026-73086",
      "cwe": {
        "id": "CWE-1241",
        "name": "Use of Predictable Algorithm in Random Number Generator"
      },
      "discovery_date": "2026-08-11T17:11:45.607696+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nanoid: nanoid: Predictable ID generation due to integer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the nanoid JavaScript library allows a remote attacker to cause predictable ID generation by exploiting an integer overflow in the `nanoid(size)` function. This can lead to the compromise of session tokens, CSRF tokens, and API keys, bypassing security mechanisms. The attack requires specific conditions, contributing to its Important severity rather than Critical.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
          "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
          "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
          "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/3.3.12",
          "url": "https://github.com/ai/nanoid/releases/tag/3.3.12"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/5.1.11",
          "url": "https://github.com/ai/nanoid/releases/tag/5.1.11"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
          "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"
        }
      ],
      "release_date": "2026-08-11T16:46:23.024000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nanoid: nanoid: Predictable ID generation due to integer overflow"
    },
    {
      "cve": "CVE-2026-73088",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-11T17:11:53.228719+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Prototype pollution leading to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability. The browserslist package, a front-end development tool, is vulnerable to prototype pollution when processing untrusted statistics data. This flaw can lead to a denial of service, as malicious input can crash applications that use the affected library. The impact is considered Important due to the potential for remote exploitation without authentication or user interaction, directly affecting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73088",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
          "url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"
        }
      ],
      "release_date": "2026-08-11T17:00:05.869000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, ensure that the `browserslist` tool processes only trusted `browserslist-stats.json`, `opts.stats`, and CLI `--stats` data. Avoid using the tool with untrusted input sources in development or build environments. If `browserslist` is integrated into automated pipelines, validate all input data originates from trusted sources.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Prototype pollution leading to denial of service"
    },
    {
      "cve": "CVE-2026-73089",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-11T17:12:48.012036+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `browserslist` library, which is used across several Red Hat products and services. The flaw allows an attacker to trigger unbounded memory growth by influencing query values, potentially leading to an out-of-memory crash and service unavailability. This is considered Important due to the potential for remote exploitation and significant impact on service stability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
        ],
        "known_not_affected": [
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
          "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73089",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
          "url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"
        }
      ],
      "release_date": "2026-08-11T17:05:38.760000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-13T19:46:27+00:00",
          "details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64",
            "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results"
    }
  ]
}

ubuntu-cve-2026-13757

Vulnerability from osv_ubuntu

Published

2026-06-29 19:16

Modified

2026-07-01 21:19

Summary

Details

Severity

6.2 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-13757	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-13757	REPORT
	https://access.redhat.com/security/cve/CVE-2026-13757	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.20.2-2ubuntu2+esm1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.20.2-2ubuntu2+esm1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.20.2-2ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.20.2-2ubuntu2+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.18.3-2ubuntu1",
        "0.20.1-2ubuntu1",
        "0.20.2-1ubuntu1",
        "0.20.2-1ubuntu2",
        "0.20.2-2ubuntu1",
        "0.20.2-2ubuntu2",
        "0.20.2-2ubuntu2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.23.2-5~ubuntu16.04.2"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.23.2-5~ubuntu16.04.2"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.23.2-5~ubuntu16.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.23.2-5~ubuntu16.04.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.1-3",
        "0.23.2-2",
        "0.23.2-3",
        "0.23.2-5~ubuntu16.04.1",
        "0.23.2-5~ubuntu16.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.23.9-2ubuntu0.1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.23.9-2ubuntu0.1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.23.9-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.23.9-2ubuntu0.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.7-3",
        "0.23.9-2",
        "0.23.9-2ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.23.20-1ubuntu0.1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.23.20-1ubuntu0.1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.23.20-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.23.20-1ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.17-2",
        "0.23.18.1-2",
        "0.23.19-2",
        "0.23.20-1",
        "0.23.20-1build1",
        "0.23.20-1ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.24.0-6build1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.24.0-6build1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.24.0-6build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.24.0-6build1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.23.22-1build1",
        "0.24.0-5",
        "0.24.0-6",
        "0.24.0-6build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.25.3-4ubuntu2.1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.25.3-4ubuntu2.1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.25.3-4ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.25.3-4ubuntu2.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.25.0-4ubuntu1",
        "0.25.3-2ubuntu2",
        "0.25.3-4ubuntu1",
        "0.25.3-4ubuntu2",
        "0.25.3-4ubuntu2.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.25.5-3ubuntu1"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.25.5-3ubuntu1"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.25.5-3ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.25.5-3ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.25.5-2ubuntu3",
        "0.25.5-3ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libp11-kit0",
            "binary_version": "0.26.2-2"
          },
          {
            "binary_name": "p11-kit",
            "binary_version": "0.26.2-2"
          },
          {
            "binary_name": "p11-kit-modules",
            "binary_version": "0.26.2-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "p11-kit",
        "purl": "pkg:deb/ubuntu/p11-kit@0.26.2-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.25.5-3ubuntu1",
        "0.25.9-2",
        "0.25.10-1",
        "0.25.10-1ubuntu1",
        "0.26.2-2"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.",
  "id": "UBUNTU-CVE-2026-13757",
  "modified": "2026-07-01T21:19:39Z",
  "published": "2026-06-29T19:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-13757"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13757"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-13757"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-13757"
  ]
}

WID-SEC-W-2026-2626

Vulnerability from csaf_certbund - Published: 2026-08-03 22:00 - Updated: 2026-08-04 22:00

Summary

Red Hat Enterprise Linux (p11-kit): Schwachstelle ermöglicht Denial of Service

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Angriff: Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.

Betroffene Betriebssysteme: - Linux

CVE-2026-13757

Affected products

Known affected 4 products

Product	Identifier	Version
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
Red Hat Enterprise Linux 10 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:10`	10

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://access.redhat.com/errata/RHSA-2026:49667	external
https://access.redhat.com/errata/RHSA-2026:49668	external
https://errata.build.resf.org/RLSA-2026:49667	external
https://errata.build.resf.org/RLSA-2026:49668	external
https://linux.oracle.com/errata/ELSA-2026-49667.html	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2626 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2626.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2626 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2626"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:49667 vom 2026-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:49667"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:49668 vom 2026-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:49668"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:49667 vom 2026-08-04",
        "url": "https://errata.build.resf.org/RLSA-2026:49667"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:49668 vom 2026-08-04",
        "url": "https://errata.build.resf.org/RLSA-2026:49668"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-49667 vom 2026-08-05",
        "url": "https://linux.oracle.com/errata/ELSA-2026-49667.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat Enterprise Linux (p11-kit): Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2026-08-04T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-05T09:03:54.235+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2626",
      "initial_release_date": "2026-08-03T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-03T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-08-04T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T056236",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T054581",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9",
                "product": {
                  "name": "Red Hat Enterprise Linux 9",
                  "product_id": "T057481",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10",
                "product": {
                  "name": "Red Hat Enterprise Linux 10",
                  "product_id": "T057482",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13757",
      "product_status": {
        "known_affected": [
          "T056236",
          "T054581",
          "T057481",
          "T057482"
        ]
      },
      "release_date": "2026-08-03T22:00:00.000+00:00",
      "title": "CVE-2026-13757"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-13757 (GCVE-0-2026-13757)

RHSA-2026:54387

RHSA-2026:54760

ubuntu-cve-2026-13757

Vulnerability from osv_ubuntu

WID-SEC-W-2026-2626

Tags

Sightings

Nomenclature