Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-2332 (GCVE-0-2026-2332)
Vulnerability from cvelistv5 – Published: 2026-04-14 10:59 – Updated: 2026-09-09 12:04
VLAI
EPSS
VEX
Title
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Summary
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:
* https://w4ke.info/2025/06/18/funky-chunks.html
* https://w4ke.info/2025/10/29/funky-chunks-2.html
Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.
POST / HTTP/1.1
Host: localhost
Transfer-Encoding: chunked
1;ext="val
X
0
GET /smuggled HTTP/1.1
...
Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-14 00:00 UTC
CWE
Assigner
References
27 references
Impacted products
43 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty |
Affected:
12.1.0 , ≤ 12.1.6
(semver)
Affected: 12.0.0 , ≤ 12.0.32 (semver) Affected: 11.0.0 , ≤ 11.0.28 (semver) Affected: 10.0.0 , ≤ 10.0.27 (semver) Affected: 9.4.0 , ≤ 9.4.59 (semver) |
guessed | |
| Red Hat | HawtIO HawtIO 4.4.0 |
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
||
| Red Hat | Red Hat AMQ Broker 7.13.5 |
cpe:/a:redhat:amq_broker:7.13
|
||
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 |
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
||
| Red Hat | Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 |
cpe:/a:redhat:apache_camel_quarkus:3.33
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:8.2.0-19.el9_8.2 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::crb |
||
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 |
Unaffected:
0:8.14.1-1.el8sat , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el8 cpe:/a:redhat:satellite_capsule:6.16::el8 |
||
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.16::el9 cpe:/a:redhat:satellite_capsule:6.16::el9 |
||
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.17::el9 cpe:/a:redhat:satellite_capsule:6.17::el9 |
||
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 cpe:/a:redhat:satellite_capsule:6.18::el9 |
||
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 |
Unaffected:
0:8.14.1-1.el9sat , < *
(rpm)
cpe:/a:redhat:satellite:6.19::el9 cpe:/a:redhat:satellite_capsule:6.19::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.12 |
Unaffected:
1786628667 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.12::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.13 |
Unaffected:
1786628681 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.13::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.14 |
Unaffected:
1786533561 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.14::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.15 |
Unaffected:
1786533565 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.15::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.16 |
Unaffected:
1787125166 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.16::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.17 |
Unaffected:
1787124635 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.17::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.18 |
Unaffected:
1787125069 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.18::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.19 |
Unaffected:
1787124632 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.19::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.20 |
Unaffected:
1787124925 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.20::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.21 |
Unaffected:
1787125311 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.21::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.22 |
Unaffected:
1787124779 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.22::el9 |
||
| Red Hat | Red Hat Offline Knowledge Portal 1.2.4 |
Unaffected:
1779996999 , < *
(rpm)
cpe:/a:redhat:offline_knowledge_portal:1.2::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
Unaffected:
1776716842 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
Unaffected:
1776717247 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
||
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools
|
||
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7
|
||
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
||
| Red Hat | Red Hat build of Apicurio Registry 2 |
cpe:/a:redhat:service_registry:2
|
||
| Red Hat | Red Hat build of Apicurio Registry 3 |
cpe:/a:redhat:apicurio_registry:3
|
||
| Red Hat | Red Hat build of Debezium 2 |
cpe:/a:redhat:debezium:2
|
||
| Red Hat | Red Hat build of Debezium 3 |
cpe:/a:redhat:debezium:3
|
||
| Red Hat | Red Hat Data Grid 8 |
cpe:/a:redhat:jboss_data_grid:8
|
||
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 |
cpe:/a:redhat:jboss_enterprise_application_platform:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat JBoss Web Server 6 |
cpe:/a:redhat:jboss_enterprise_web_server:6
|
||
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2332",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T03:58:12.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4.4::el9"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "HawtIO HawtIO 4.4.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7.13"
],
"defaultStatus": "unaffected",
"product": "Red Hat AMQ Broker 7.13.5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_quarkus:3.33"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"packageName": "jmc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.2.0-19.el9_8.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el8",
"cpe:/a:redhat:satellite_capsule:6.16::el8"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.16 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el8sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.16::el9",
"cpe:/a:redhat:satellite_capsule:6.16::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.16 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.17::el9",
"cpe:/a:redhat:satellite_capsule:6.17::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.17 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9",
"cpe:/a:redhat:satellite_capsule:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.18 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9",
"cpe:/a:redhat:satellite_capsule:6.19::el9"
],
"defaultStatus": "affected",
"packageName": "openvox-server",
"product": "Red Hat Satellite 6.19 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:8.14.1-1.el9sat",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628667",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.13::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628681",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.14::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533561",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.15::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533565",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125166",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124635",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125069",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124632",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124925",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125311",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124779",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:offline_knowledge_portal:1.2::el9"
],
"defaultStatus": "affected",
"packageName": "offline-knowledge-portal/rhokp-rhel9",
"product": "Red Hat Offline Knowledge Portal 1.2.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779996999",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776716842",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776717247",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:2"
],
"defaultStatus": "unknown",
"packageName": "jetty-http",
"product": "Red Hat build of Debezium 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_web_server:6"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat JBoss Web Server 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "jetty-http",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "puppetserver",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "satellite-capsule:el8/puppetserver",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "jetty-http",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-14T10:59:10.193Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:04:48.883Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"name": "RHBZ#2458187",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50223"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50263"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22453"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:50223: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:50222: Red Hat Satellite 6.17 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:50263: Red Hat Satellite 6.18 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:50221: Red Hat Satellite 6.19 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:20568: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25089: HawtIO HawtIO 4.4.0"
},
{
"lang": "en",
"value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:14272: Red Hat AMQ Broker 7.13.5"
},
{
"lang": "en",
"value": "RHSA-2026:22453: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
},
{
"lang": "en",
"value": "RHSA-2026:21773: Red Hat Offline Knowledge Portal 1.2.4"
},
{
"lang": "en",
"value": "RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-14T12:01:05.768Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-14T10:59:10.193Z",
"value": "Made public."
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"workarounds": [
{
"lang": "en",
"value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "pkg://maven/org.eclipse.jetty/jetty-http",
"product": "Eclipse Jetty",
"repo": "https://github.com/jetty/jetty.project",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "12.1.6",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.0.32",
"status": "affected",
"version": "12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.0.28",
"status": "affected",
"version": "11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.27",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.59",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/xclow3n"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\u003cbr\u003e\u003cul\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/06/18/funky-chunks.html\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/10/29/funky-chunks-2.html\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003eJetty terminates chunk extension parsing at\u0026nbsp;\u003ccode\u003e\\r\\n\u003c/code\u003e\u0026nbsp;inside quoted strings instead of treating this as an error.\u003cbr\u003e\u003cbr\u003e\n\u003cpre\u003ePOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\u003c/pre\u003e\n\n\u003cdiv\u003e\u003cbr\u003eNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at\u00a0\\r\\n\u00a0inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:04:06.097Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"tags": [
"issue-tracking"
],
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP Request Smuggling via Chunked Extension Quoted-String Parsing",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-2332",
"datePublished": "2026-04-14T10:59:10.193Z",
"dateReserved": "2026-02-11T09:56:25.879Z",
"dateUpdated": "2026-09-09T12:04:48.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-2332",
"date": "2026-09-09",
"epss": "0.01305",
"percentile": "0.68818"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-2332\",\"sourceIdentifier\":\"emo@eclipse.org\",\"published\":\"2026-04-14T12:16:21.333\",\"lastModified\":\"2026-09-09T13:19:12.390\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \\\"funky chunks\\\" techniques outlined here:\\n * https://w4ke.info/2025/06/18/funky-chunks.html\\n\\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\\n\\n\\nJetty terminates chunk extension parsing at\u00a0\\\\r\\\\n\u00a0inside quoted strings instead of treating this as an error.\\n\\n\\n\\n\\nPOST / HTTP/1.1\\nHost: localhost\\nTransfer-Encoding: chunked\\n\\n1;ext=\\\"val\\nX\\n0\\n\\nGET /smuggled HTTP/1.1\\n...\\n\\n\\n\\n\\n\\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\"}],\"affected\":[{\"source\":\"emo@eclipse.org\",\"affectedData\":[{\"vendor\":\"Eclipse Foundation\",\"product\":\"Eclipse Jetty\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"pkg://maven/org.eclipse.jetty/jetty-http\",\"repo\":\"https://github.com/jetty/jetty.project\",\"versions\":[{\"version\":\"12.1.0\",\"lessThanOrEqual\":\"12.1.6\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"12.0.0\",\"lessThanOrEqual\":\"12.0.32\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"11.0.0\",\"lessThanOrEqual\":\"11.0.28\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"lessThanOrEqual\":\"10.0.27\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"9.4.0\",\"lessThanOrEqual\":\"9.4.59\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"HawtIO HawtIO 4.4.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7.13.5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7.13\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apache_camel_quarkus:3.33\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jmc\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::crb\"],\"versions\":[{\"version\":\"0:8.2.0-19.el9_8.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el8\",\"cpe:/a:redhat:satellite_capsule:6.16::el8\"],\"versions\":[{\"version\":\"0:8.14.1-1.el8sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.16 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.16::el9\",\"cpe:/a:redhat:satellite_capsule:6.16::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.17 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.17::el9\",\"cpe:/a:redhat:satellite_capsule:6.17::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\",\"cpe:/a:redhat:satellite_capsule:6.18::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openvox-server\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\",\"cpe:/a:redhat:satellite_capsule:6.19::el9\"],\"versions\":[{\"version\":\"0:8.14.1-1.el9sat\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.12::el8\"],\"versions\":[{\"version\":\"1786628667\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.13::el8\"],\"versions\":[{\"version\":\"1786628681\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.14::el8\"],\"versions\":[{\"version\":\"1786533561\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.15::el8\"],\"versions\":[{\"version\":\"1786533565\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.16::el9\"],\"versions\":[{\"version\":\"1787125166\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.17::el9\"],\"versions\":[{\"version\":\"1787124635\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.18::el9\"],\"versions\":[{\"version\":\"1787125069\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.19::el9\"],\"versions\":[{\"version\":\"1787124632\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.20::el9\"],\"versions\":[{\"version\":\"1787124925\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.21::el9\"],\"versions\":[{\"version\":\"1787125311\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.22::el9\"],\"versions\":[{\"version\":\"1787124779\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Offline Knowledge Portal 1.2.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"offline-knowledge-portal/rhokp-rhel9\",\"cpes\":[\"cpe:/a:redhat:offline_knowledge_portal:1.2::el9\"],\"versions\":[{\"version\":\"1779996999\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"],\"versions\":[{\"version\":\"1776716842\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"],\"versions\":[{\"version\":\"1776717247\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:service_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 2\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:debezium:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Web Server 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_web_server:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"puppetserver\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite-capsule:el8/puppetserver\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jetty-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"emo@eclipse.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-14T00:00:00+00:00\",\"id\":\"CVE-2026-2332\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"emo@eclipse.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.4.0\",\"versionEndExcluding\":\"9.4.60\",\"matchCriteriaId\":\"E0FB149B-EF33-4A51-9B96-030899E250CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.28\",\"matchCriteriaId\":\"361D419A-7A89-439A-99B1-D34E9914BAE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.0.28\",\"matchCriteriaId\":\"7020D8E5-61DD-4DB6-82E4-EA46A96838A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.0.0\",\"versionEndExcluding\":\"12.0.33\",\"matchCriteriaId\":\"E1A6095F-3D1E-40CB-A875-D41BF6C73EB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.1.0\",\"versionEndExcluding\":\"12.1.7\",\"matchCriteriaId\":\"B5A32954-7B03-46B6-9956-54BE0F8477E8\"}]}]}],\"references\":[{\"url\":\"https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf\",\"source\":\"emo@eclipse.org\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://gitlab.eclipse.org/security/cve-assignment/-/issues/89\",\"source\":\"emo@eclipse.org\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10175\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14272\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17668\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21773\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22453\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25089\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50221\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50222\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50223\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50263\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60239\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60247\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60248\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60249\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60251\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60254\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60256\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60259\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-2332\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2458187\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-09T22:24:37+00:00",
"cve": "CVE-2026-2332",
"id": "CVE-2026-2332",
"initial_release_date": "2026-04-14T10:59:10.193000+00:00",
"product_status:fixed": "74",
"product_status:known_affected": "14",
"product_status:known_not_affected": "451",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:apache_camel_hawtio:4.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"HawtIO HawtIO 4.4.0\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7.13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7.13.5\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_quarkus:3.33\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.2.0-19.el9_8.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"jmc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el8\", \"cpe:/a:redhat:satellite_capsule:6.16::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el8sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.16::el9\", \"cpe:/a:redhat:satellite_capsule:6.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.16 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.17::el9\", \"cpe:/a:redhat:satellite_capsule:6.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.17 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\", \"cpe:/a:redhat:satellite_capsule:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\", \"cpe:/a:redhat:satellite_capsule:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.14.1-1.el9sat\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openvox-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628667\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.13::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628681\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533561\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533565\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125166\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124635\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125069\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124632\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124925\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125311\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124779\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:offline_knowledge_portal:1.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Offline Knowledge Portal 1.2.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779996999\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"offline-knowledge-portal/rhokp-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776716842\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/openvsx-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776717247\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/pluginregistry-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 2\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_web_server:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Web Server 6\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"puppetserver\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite-capsule:el8/puppetserver\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"jetty-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-14T12:01:05.768Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-14T10:59:10.193Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:50223: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50222: Red Hat Satellite 6.17 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50263: Red Hat Satellite 6.18 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50221: Red Hat Satellite 6.19 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20568: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25089: HawtIO HawtIO 4.4.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60247: OpenShift Developer Tools and Services 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60249: OpenShift Developer Tools and Services 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60248: OpenShift Developer Tools and Services 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60239: OpenShift Developer Tools and Services 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60251: OpenShift Developer Tools and Services 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60246: OpenShift Developer Tools and Services 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60250: OpenShift Developer Tools and Services 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60252: OpenShift Developer Tools and Services 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60259: OpenShift Developer Tools and Services 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60254: OpenShift Developer Tools and Services 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60256: OpenShift Developer Tools and Services 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14272: Red Hat AMQ Broker 7.13.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22453: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21773: Red Hat Offline Knowledge Portal 1.2.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-14T10:59:10.193Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-2332\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2458187\", \"name\": \"RHBZ#2458187\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2332.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50223\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50222\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50263\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50221\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20568\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25089\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60247\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60249\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60248\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60239\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60251\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60252\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60259\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60254\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60256\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14272\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22453\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21773\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10175\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-444\", \"description\": \"Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-09-09T12:04:48.883Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-2332\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-14T13:06:34.622366Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-14T13:08:48.379Z\"}}], \"cna\": {\"title\": \"HTTP Request Smuggling via Chunked Extension Quoted-String Parsing\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"https://github.com/xclow3n\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/jetty/jetty.project\", \"vendor\": \"Eclipse Foundation\", \"product\": \"Eclipse Jetty\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.1.6\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.0.32\"}, {\"status\": \"affected\", \"version\": \"11.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.0.28\"}, {\"status\": \"affected\", \"version\": \"10.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.0.27\"}, {\"status\": \"affected\", \"version\": \"9.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.4.59\"}], \"packageName\": \"pkg://maven/org.eclipse.jetty/jetty-http\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://gitlab.eclipse.org/security/cve-assignment/-/issues/89\", \"tags\": [\"issue-tracking\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \\\"funky chunks\\\" techniques outlined here:\\n * https://w4ke.info/2025/06/18/funky-chunks.html\\n\\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\\n\\n\\nJetty terminates chunk extension parsing at\\u00a0\\\\r\\\\n\\u00a0inside quoted strings instead of treating this as an error.\\n\\n\\n\\n\\nPOST / HTTP/1.1\\nHost: localhost\\nTransfer-Encoding: chunked\\n\\n1;ext=\\\"val\\nX\\n0\\n\\nGET /smuggled HTTP/1.1\\n...\\n\\n\\n\\n\\n\\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \\\"funky chunks\\\" techniques outlined here:\u003cbr\u003e\u003cul\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/06/18/funky-chunks.html\u003c/span\u003e\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003ehttps://w4ke.info/2025/10/29/funky-chunks-2.html\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003eJetty terminates chunk extension parsing at\u0026nbsp;\u003ccode\u003e\\\\r\\\\n\u003c/code\u003e\u0026nbsp;inside quoted strings instead of treating this as an error.\u003cbr\u003e\u003cbr\u003e\\n\u003cpre\u003ePOST / HTTP/1.1\\nHost: localhost\\nTransfer-Encoding: chunked\\n\\n1;ext=\\\"val\\nX\\n0\\n\\nGET /smuggled HTTP/1.1\\n...\\n\u003c/pre\u003e\\n\\n\u003cdiv\u003e\u003cbr\u003eNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.\u003cbr\u003e\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-444\", \"description\": \"CWE-444 Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"e51fbebd-6053-4e49-959f-1b94eeb69a2c\", \"shortName\": \"eclipse\", \"dateUpdated\": \"2026-08-17T15:04:06.097Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-2332\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-09T12:04:48.883Z\", \"dateReserved\": \"2026-02-11T09:56:25.879Z\", \"assignerOrgId\": \"e51fbebd-6053-4e49-959f-1b94eeb69a2c\", \"datePublished\": \"2026-04-14T10:59:10.193Z\", \"assignerShortName\": \"eclipse\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
NCSC-2026-0356
Vulnerability from csaf_ncscnl - Published: 2026-09-09 12:59 - Updated: 2026-09-09 12:59Summary
Kwetsbaarheden verholpen in diverse SAP-producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence.
Interpretaties: De kwetsbaarheid met kenmerk CVE-2026-44756 heeft CVSS-score van 10. Het betreft een geheugenveiligheidsprobleem in de EPP processing library dat kan worden geactiveerd door niet-geauthenticeerde aanvallers die malformed EPP headers versturen. Deze geheugenbeschadiging kan leiden tot ongedefinieerd gedrag, wat de vertrouwelijkheid, integriteit en beschikbaarheid van de applicatie kan beïnvloeden. De kwetsbaarheid ontstaat door onjuiste verwerking van EPP headers binnen de SAP EPP processing library. Exploitatie vereist geen authenticatie.
De kwetsbaarheid met kenmerk CVE-2026-58240 heeft CVSS-score van 9.8. Het betreft het ontbreken van een authenticatiemechanisme bij de registratie van interne applicatieservercomponenten. Hierdoor valideert het systeem niet correct of de componenten legitiem zijn. Een niet-geauthenticeerde aanvaller met netwerktoegang kan hierdoor ongeautoriseerde componenten registreren binnen de Message Server-omgeving. Dit kan leiden tot compromittering van de vertrouwelijkheid, integriteit en beschikbaarheid van de getroffen SAP NetWeaver-systemen.
De kwetsbaarheid met kenmerk CVE-2026-76969 heeft CVSS-score van 9.4. De kwetsbaarheid maakt het mogelijk voor niet-geauthenticeerde aanvallers om gevoelige credentials te verkrijgen. Dit kan leiden tot ongeautoriseerde toegang en manipulatie van tenantgegevens. De kwetsbaarheid betreft credential disclosure in multitenant CAP-applicaties en beïnvloedt de vertrouwelijkheid, integriteit en beschikbaarheid van de getroffen systemen.
De kwetsbaarheid met kenmerk CVE-2026-66768 heeft CVSS-score van 9.0. De kwetsbaarheid betreft een onjuiste toegangcontrole en het niet correct afdwingen van trust level policies in SAP GUI for Java. Hierdoor kan een aanvaller met lage privileges willekeurige commando's uitvoeren door misbruik te maken van zwakheden in de backend verwerking van trust policies. Dit beïnvloedt de integriteit van het beveiligingsmodel van het systeem.
De overige kwetsbaarheden variëren in ernst van middelmatig tot hoog en betreffen diverse beveiligingsproblemen zoals:
- niet juist uitvoeren van autorisatiecontroles in SAP ABAP Developer Tools
- XML External Entity (XXE) in SAP Integration Suite
- onveilige deserialisatie in SAP NetWeaver Business Client
- geheugenbeschadiging in SAP NetWeaver Application Server for ABAP en ABAP Platform
- CRLF-injectie door het gebruik van Jetty-componenten in SAP Commerce Cloud
- informatielek in SAP Web Dispatcher, Internet Communication Manager en SAP Content Server
- SQL-injectie in SAP S/4HANA (Intercompany Matching and Reconciliation)
- Server-Side Request Forgery (SSRF) in SAP Manufacturing Integration and Intelligence
Deze kwetsbaarheden kunnen leiden tot privilege-escalatie, ongeautoriseerde toegang, informatielekken, gegevensmanipulatie en verstoring van de beschikbaarheid. Meerdere kwetsbaarheden kunnen zonder authenticatie worden uitgebuit. De kwetsbaarheden treffen diverse SAP-componenten, waaronder SAP ABAP Developer Tools, SAP Integration Suite, SAP NetWeaver, SAP Commerce Cloud, SAP Web Dispatcher, SAP S/4HANA en SAP Manufacturing Integration and Intelligence.
Oplossingen: SAP heeft updates uitgebracht om de kwetsbaarheden in de genoemde producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-308: Use of Single-factor Authentication
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
CWE-502: Deserialization of Untrusted Data
CWE-522: Insufficiently Protected Credentials
CWE-611: Improper Restriction of XML External Entity Reference
CWE-807: Reliance on Untrusted Inputs in a Security Decision
CWE-862: Missing Authorization
CWE-918: Server-Side Request Forgery (SSRF)
A memory corruption vulnerability in the SAP Extended Passport Protocol (EPP) processing library allows unauthenticated attackers to exploit malformed EPP headers, potentially causing undefined behavior and impacting confidentiality, integrity, and availability.
10.0 (Critical)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
SAP NetWeaver Message Server contains a vulnerability due to lack of authentication during internal application server component registration, enabling unauthenticated attackers with network access to register unauthorized components and compromise system security.
9.8 (Critical)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
A security vulnerability in the @sap/cds-mtxs NPM library affects multitenant SAP CAP applications with extensibility enabled, allowing unauthenticated attackers to disclose sensitive credentials and potentially manipulate tenant data.
9.4 (Critical)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
SAP NetWeaver's SAP GUI for Java contains an access control vulnerability that allows low-privileged attackers to execute arbitrary commands by exploiting improper enforcement of trust level policies in the backend system.
9.0 (Critical)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
SAP ABAP Development Tools contain a privilege escalation vulnerability due to insufficient authorization checks, allowing low-privilege attackers to perform unauthorized database operations on SAP NetWeaver AS ABAP.
8.8 (High)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
SAP Integration Suite contains an XML External Entity (XXE) vulnerability due to insufficient validation of XML documents from untrusted sources, allowing low-privilege attackers to access sensitive server files and potentially exhaust resources.
8.5 (High)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
SAP NetWeaver Business Client is affected by an insecure deserialization vulnerability and insufficient validation of locally stored data during startup, enabling low-privilege attackers to execute arbitrary code.
7.8 (High)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
An authenticated low-privileged attacker can exploit information disclosure vulnerabilities in SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server, impacting confidentiality without affecting integrity or availability.
6.5 (Medium)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
SAP S/4HANA Intercompany Matching and Reconciliation contains an SQL Injection vulnerability allowing low-privileged authenticated users to inject malicious input, potentially exposing sensitive data and compromising confidentiality.
6.5 (Medium)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
An SSRF vulnerability in SAP Manufacturing Integration and Intelligence allows attackers to make the server send arbitrary outbound requests, potentially enabling script execution with limited impact on confidentiality, integrity, and availability.
6.5 (Medium)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
Eclipse Jetty's HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can lead to security bypass, cache poisoning, and unauthorized access across multiple affected products.
9.1 (Critical)
Affected products
Known affected
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
SAP / Content Server, Internet Communication Manager, Web Dispatcher
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Extended Passport Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / GUI for Java
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / NetWeaver Message Server
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / S4HANA
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / SAP Software
|
vers:unknown/* | ||
|
vers:unknown/*
SAP / netweaver
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP ABAP Developer Tools
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Cloud Application Programming Model (CAP)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Extended Passport (EPP) Processing
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Integration Suite
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Manufacturing Integration and Intelligence
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (Message Server)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver (SAP GUI for Java)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP NetWeaver Business Client
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP S/4HANA (Intercompany Matching and Reconciliation)
|
vers:unknown/* | ||
|
vers:unknown/*
SAP_SE / SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
|
vers:unknown/* |
References
12 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheid met kenmerk CVE-2026-44756 heeft CVSS-score van 10. Het betreft een geheugenveiligheidsprobleem in de EPP processing library dat kan worden geactiveerd door niet-geauthenticeerde aanvallers die malformed EPP headers versturen. Deze geheugenbeschadiging kan leiden tot ongedefinieerd gedrag, wat de vertrouwelijkheid, integriteit en beschikbaarheid van de applicatie kan be\u00efnvloeden. De kwetsbaarheid ontstaat door onjuiste verwerking van EPP headers binnen de SAP EPP processing library. Exploitatie vereist geen authenticatie.\n\nDe kwetsbaarheid met kenmerk CVE-2026-58240 heeft CVSS-score van 9.8. Het betreft het ontbreken van een authenticatiemechanisme bij de registratie van interne applicatieservercomponenten. Hierdoor valideert het systeem niet correct of de componenten legitiem zijn. Een niet-geauthenticeerde aanvaller met netwerktoegang kan hierdoor ongeautoriseerde componenten registreren binnen de Message Server-omgeving. Dit kan leiden tot compromittering van de vertrouwelijkheid, integriteit en beschikbaarheid van de getroffen SAP NetWeaver-systemen.\n\nDe kwetsbaarheid met kenmerk CVE-2026-76969 heeft CVSS-score van 9.4. De kwetsbaarheid maakt het mogelijk voor niet-geauthenticeerde aanvallers om gevoelige credentials te verkrijgen. Dit kan leiden tot ongeautoriseerde toegang en manipulatie van tenantgegevens. De kwetsbaarheid betreft credential disclosure in multitenant CAP-applicaties en be\u00efnvloedt de vertrouwelijkheid, integriteit en beschikbaarheid van de getroffen systemen.\n\nDe kwetsbaarheid met kenmerk CVE-2026-66768 heeft CVSS-score van 9.0. De kwetsbaarheid betreft een onjuiste toegangcontrole en het niet correct afdwingen van trust level policies in SAP GUI for Java. Hierdoor kan een aanvaller met lage privileges willekeurige commando\u0027s uitvoeren door misbruik te maken van zwakheden in de backend verwerking van trust policies. Dit be\u00efnvloedt de integriteit van het beveiligingsmodel van het systeem.\n\nDe overige kwetsbaarheden vari\u00ebren in ernst van middelmatig tot hoog en betreffen diverse beveiligingsproblemen zoals:\n\n- niet juist uitvoeren van autorisatiecontroles in SAP ABAP Developer Tools\n- XML External Entity (XXE) in SAP Integration Suite\n- onveilige deserialisatie in SAP NetWeaver Business Client\n- geheugenbeschadiging in SAP NetWeaver Application Server for ABAP en ABAP Platform\n- CRLF-injectie door het gebruik van Jetty-componenten in SAP Commerce Cloud\n- informatielek in SAP Web Dispatcher, Internet Communication Manager en SAP Content Server\n- SQL-injectie in SAP S/4HANA (Intercompany Matching and Reconciliation)\n- Server-Side Request Forgery (SSRF) in SAP Manufacturing Integration and Intelligence\n\nDeze kwetsbaarheden kunnen leiden tot privilege-escalatie, ongeautoriseerde toegang, informatielekken, gegevensmanipulatie en verstoring van de beschikbaarheid. Meerdere kwetsbaarheden kunnen zonder authenticatie worden uitgebuit. De kwetsbaarheden treffen diverse SAP-componenten, waaronder SAP ABAP Developer Tools, SAP Integration Suite, SAP NetWeaver, SAP Commerce Cloud, SAP Web Dispatcher, SAP S/4HANA en SAP Manufacturing Integration and Intelligence.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "SAP heeft updates uitgebracht om de kwetsbaarheden in de genoemde producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "general",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "Use of Single-factor Authentication",
"title": "CWE-308"
},
{
"category": "general",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"title": "CWE-444"
},
{
"category": "general",
"text": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"title": "CWE-497"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Insufficiently Protected Credentials",
"title": "CWE-522"
},
{
"category": "general",
"text": "Improper Restriction of XML External Entity Reference",
"title": "CWE-611"
},
{
"category": "general",
"text": "Reliance on Untrusted Inputs in a Security Decision",
"title": "CWE-807"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html"
}
],
"title": "Kwetsbaarheden verholpen in diverse SAP-producten",
"tracking": {
"current_release_date": "2026-09-09T12:59:58.201157Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0356",
"initial_release_date": "2026-09-09T12:59:58.201157Z",
"revision_history": [
{
"date": "2026-09-09T12:59:58.201157Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Content Server, Internet Communication Manager, Web Dispatcher"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Extended Passport Processing"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "GUI for Java"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Integration Suite"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Manufacturing Integration and Intelligence"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "NetWeaver"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "NetWeaver Business Client"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "NetWeaver Message Server"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "S4HANA"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "SAP Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "netweaver"
}
],
"category": "vendor",
"name": "SAP"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "SAP ABAP Developer Tools"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "SAP Cloud Application Programming Model (CAP)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "SAP Extended Passport (EPP) Processing"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "SAP Integration Suite"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "SAP Manufacturing Integration and Intelligence"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver (Message Server)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver (SAP GUI for Java)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "SAP NetWeaver Business Client"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-20"
}
}
],
"category": "product_name",
"name": "SAP S/4HANA (Intercompany Matching and Reconciliation)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-21"
}
}
],
"category": "product_name",
"name": "SAP Web Dispatcher, Internet Communication Manager and SAP Content Server"
}
],
"category": "vendor",
"name": "SAP_SE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-44756",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "description",
"text": "A memory corruption vulnerability in the SAP Extended Passport Protocol (EPP) processing library allows unauthenticated attackers to exploit malformed EPP headers, potentially causing undefined behavior and impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44756 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44756.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-44756"
},
{
"cve": "CVE-2026-58240",
"cwe": {
"id": "CWE-308",
"name": "Use of Single-factor Authentication"
},
"notes": [
{
"category": "other",
"text": "Use of Single-factor Authentication",
"title": "CWE-308"
},
{
"category": "description",
"text": "SAP NetWeaver Message Server contains a vulnerability due to lack of authentication during internal application server component registration, enabling unauthenticated attackers with network access to register unauthorized components and compromise system security.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-58240 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58240.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-58240"
},
{
"cve": "CVE-2026-76969",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"notes": [
{
"category": "other",
"text": "Insufficiently Protected Credentials",
"title": "CWE-522"
},
{
"category": "description",
"text": "A security vulnerability in the @sap/cds-mtxs NPM library affects multitenant SAP CAP applications with extensibility enabled, allowing unauthenticated attackers to disclose sensitive credentials and potentially manipulate tenant data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-76969 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76969.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-76969"
},
{
"cve": "CVE-2026-66768",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"notes": [
{
"category": "other",
"text": "Reliance on Untrusted Inputs in a Security Decision",
"title": "CWE-807"
},
{
"category": "description",
"text": "SAP NetWeaver\u0027s SAP GUI for Java contains an access control vulnerability that allows low-privileged attackers to execute arbitrary commands by exploiting improper enforcement of trust level policies in the backend system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-66768 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66768.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-66768"
},
{
"cve": "CVE-2026-58243",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "SAP ABAP Development Tools contain a privilege escalation vulnerability due to insufficient authorization checks, allowing low-privilege attackers to perform unauthorized database operations on SAP NetWeaver AS ABAP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-58243 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58243.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-58243"
},
{
"cve": "CVE-2026-76958",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of XML External Entity Reference",
"title": "CWE-611"
},
{
"category": "description",
"text": "SAP Integration Suite contains an XML External Entity (XXE) vulnerability due to insufficient validation of XML documents from untrusted sources, allowing low-privilege attackers to access sensitive server files and potentially exhaust resources.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-76958 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76958.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-76958"
},
{
"cve": "CVE-2026-76967",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "SAP NetWeaver Business Client is affected by an insecure deserialization vulnerability and insufficient validation of locally stored data during startup, enabling low-privilege attackers to execute arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-76967 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76967.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-76967"
},
{
"cve": "CVE-2026-76968",
"cwe": {
"id": "CWE-497",
"name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"title": "CWE-497"
},
{
"category": "description",
"text": "An authenticated low-privileged attacker can exploit information disclosure vulnerabilities in SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server, impacting confidentiality without affecting integrity or availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-76968 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76968.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-76968"
},
{
"cve": "CVE-2026-44766",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "description",
"text": "SAP S/4HANA Intercompany Matching and Reconciliation contains an SQL Injection vulnerability allowing low-privileged authenticated users to inject malicious input, potentially exposing sensitive data and compromising confidentiality.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44766 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44766.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-44766"
},
{
"cve": "CVE-2026-76971",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "description",
"text": "An SSRF vulnerability in SAP Manufacturing Integration and Intelligence allows attackers to make the server send arbitrary outbound requests, potentially enabling script execution with limited impact on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-76971 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-76971.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-76971"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"notes": [
{
"category": "other",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"title": "CWE-444"
},
{
"category": "description",
"text": "Eclipse Jetty\u0027s HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can lead to security bypass, cache poisoning, and unauthorized access across multiple affected products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-2332 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2332.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21"
]
}
],
"title": "CVE-2026-2332"
}
]
}
RHSA-2026:10175
Vulnerability from csaf_redhat - Published: 2026-04-23 14:43 - Updated: 2026-09-10 11:55Summary
Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.1 Release.
Severity
Important
Notes
Topic: Red Hat OpenShift Dev Spaces 3.27.1 has been released.
Details: Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.
The 3.27 release is based on Eclipse Che 7.115 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2.
Users still using the v1 standard should migrate as soon as possible.
https://devfile.io/docs/2.2.0/migrating-to-devfile-v2
Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates.
https://access.redhat.com/support/policy/updates/openshift#crw
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.
7.0 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
53 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
53 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
53 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.
8.2 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
53 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Moderate
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote unauthenticated client can exploit this vulnerability by sending an incomplete Transport Layer Security (TLS) record, which causes the TLS handshake to stall indefinitely. This can lead to resource exhaustion, such as file descriptors and goroutines, ultimately degrading the availability of all services on the affected entrypoint, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote unauthenticated client can exploit a case sensitivity vulnerability in how Traefik processes HTTP/1.1 requests. By using lowercase tokens in the Connection header, an attacker can bypass security protections, leading to the removal of Traefik-managed forwarded identity headers. This could result in information disclosure or misattribution of client requests.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending fragmented ClientHello packets during the Transport Layer Security (TLS) handshake. This causes Traefik's Server Name Indication (SNI) extraction to fail, leading to a fallback to a default TLS configuration that does not require client certificates. This allows an attacker to bypass mutual TLS (mTLS) authentication, gaining unauthorized access to services that should be protected by client certificate requirements.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When using the Knative provider, Traefik incorrectly interpolates user-controlled values into router rule expressions without proper escaping. This vulnerability allows an attacker to inject malicious rule syntax, leading to a host restriction bypass. In multi-tenant environments, this can result in unauthorized traffic being routed to victim services, potentially exposing cross-tenant traffic.
7.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When the `headerField` is configured with a non-canonical HTTP header name, an authenticated attacker can inject a canonical version of that header. This allows the attacker to impersonate any identity to the backend, leading to an authentication bypass. The backend prioritizes the attacker-injected header, overriding Traefik's intended header.
7.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in @fastify/reply-from and @fastify/http-proxy. A remote attacker can exploit this vulnerability by manipulating the Connection header in client requests. This allows the attacker to remove specific headers that the proxy has added for security, routing, or access control purposes. Consequently, an attacker could bypass security mechanisms or gain unauthorized access to resources.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Vendor Fix
fix
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Threats
Impact
Important
A flaw was found in Handlebars. An attacker can exploit this by supplying a crafted Abstract Syntax Tree (AST) object to the `Handlebars.compile()` function. This allows the injection and execution of arbitrary JavaScript code due to improper sanitization of the `value` field in `NumberLiteral` AST nodes. This vulnerability can lead to Remote Code Execution (RCE) on the server.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Handlebars. A remote attacker can exploit this vulnerability by manipulating the `@partial-block` special variable within the template data context. By overwriting `@partial-block` with a specially crafted Abstract Syntax Tree (AST) through a helper, a subsequent invocation of `{{> @partial-block}}` will compile and execute the malicious AST. This enables arbitrary JavaScript execution on the server, leading to potential compromise of the system.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Handlebars.js. A remote attacker can exploit this by submitting a malformed Handlebars template that includes decorator syntax referencing an unregistered decorator. When the application attempts to compile this template without proper error handling, it triggers an unhandled `TypeError`. This error causes the Node.js process to crash, resulting in a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Handlebars.js. A remote attacker can exploit this vulnerability by providing a specially crafted object within the template context. This crafted object, when processed by a dynamic partial lookup, can bypass security checks and be interpreted as malicious code. This allows the attacker to execute arbitrary commands on the server where Handlebars.js is running.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Handlebars. The Handlebars command-line interface (CLI) precompiler concatenates user-controlled strings, such as template file names and CLI options, directly into the generated JavaScript without proper escaping or sanitization. An attacker capable of influencing these inputs can inject arbitrary JavaScript code. This can lead to arbitrary code execution when the generated JavaScript bundle is loaded in a Node.js environment or a web browser.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le | — |
Vendor Fix
fix
|
Known not affected
53 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x | — |
Threats
Impact
Important
References
190 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Dev Spaces 3.27.1 has been released.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.\nThe 3.27 release is based on Eclipse Che 7.115 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2.\nUsers still using the v1 standard should migrate as soon as possible.\nhttps://devfile.io/docs/2.2.0/migrating-to-devfile-v2\nDev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates.\nhttps://access.redhat.com/support/policy/updates/openshift#crw",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:10175",
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.27/html/administration_guide/installing-devspaces",
"url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.27/html/administration_guide/installing-devspaces"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61728",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22731",
"url": "https://access.redhat.com/security/cve/CVE-2026-22731"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-26999",
"url": "https://access.redhat.com/security/cve/CVE-2026-26999"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27606",
"url": "https://access.redhat.com/security/cve/CVE-2026-27606"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29054",
"url": "https://access.redhat.com/security/cve/CVE-2026-29054"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32305",
"url": "https://access.redhat.com/security/cve/CVE-2026-32305"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32695",
"url": "https://access.redhat.com/security/cve/CVE-2026-32695"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33433",
"url": "https://access.redhat.com/security/cve/CVE-2026-33433"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33805",
"url": "https://access.redhat.com/security/cve/CVE-2026-33805"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33870",
"url": "https://access.redhat.com/security/cve/CVE-2026-33870"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33871",
"url": "https://access.redhat.com/security/cve/CVE-2026-33871"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33937",
"url": "https://access.redhat.com/security/cve/CVE-2026-33937"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33938",
"url": "https://access.redhat.com/security/cve/CVE-2026-33938"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33939",
"url": "https://access.redhat.com/security/cve/CVE-2026-33939"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33940",
"url": "https://access.redhat.com/security/cve/CVE-2026-33940"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33941",
"url": "https://access.redhat.com/security/cve/CVE-2026-33941"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4926",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10175.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.1 Release.",
"tracking": {
"current_release_date": "2026-09-10T11:55:56+00:00",
"generator": {
"date": "2026-09-10T11:55:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:10175",
"initial_release_date": "2026-04-23T14:43:48+00:00",
"revision_history": [
{
"date": "2026-04-23T14:43:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T11:55:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Dev Spaces 3.27",
"product": {
"name": "Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_devspaces:3.27::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Dev Spaces"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3Abaccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776744110"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3A45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776743204"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3A977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718450"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3A339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795511"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3Ad3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718438"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3Ade2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795400"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3A1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776774989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3Abf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776716842"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3Ad05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"product_id": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-operator-bundle@sha256%3A961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776803772"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3A27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776717247"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3A57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776796445"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3A179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718585"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776789889"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3Ae1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776777278"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3A08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3?arch=amd64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776778243"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3A6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776744110"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3A70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776743204"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3A59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718450"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3A13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795511"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3A3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718438"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3A4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795400"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3A5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776774989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3Ad0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776716842"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3A1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3Afb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776717247"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3A7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776796445"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3Acbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718585"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776789889"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3A8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776777278"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3A9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e?arch=s390x\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776778243"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3Aab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776744110"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3A215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776743204"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3A24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718450"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3A633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795511"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3A926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718438"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3A7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795400"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3A7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776774989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3Ab2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776716842"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3Adcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3Ae224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776717247"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3A88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776796445"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3Aee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718585"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776789889"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3A02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776777278"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3A17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776778243"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3A56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776744110"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3Af7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776743204"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3Acb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718450"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3A25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795511"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3A6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718438"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3Af72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776795400"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3A4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776774989"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3A12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776716842"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3Ab725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3Ae832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776717247"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3Ad97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776796445"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3A34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776718585"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776789889"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3Ae6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776777278"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3Ab65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5?arch=arm64\u0026repository_url=registry.redhat.io/devspaces\u0026tag=1776778243"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64 as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x as a component of Red Hat OpenShift Dev Spaces 3.27",
"product_id": "Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.27"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:39.965024+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434431"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "RHBZ#2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://go.dev/cl/736713",
"url": "https://go.dev/cl/736713"
},
{
"category": "external",
"summary": "https://go.dev/issue/77102",
"url": "https://go.dev/issue/77102"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4342",
"url": "https://pkg.go.dev/vuln/GO-2026-4342"
}
],
"release_date": "2026-01-28T19:30:31.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
},
{
"cve": "CVE-2025-62718",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-09T15:01:48.111177+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456913"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-62718"
},
{
"category": "external",
"summary": "RHBZ#2456913",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
"url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
},
{
"category": "external",
"summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
"url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
"url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10661",
"url": "https://github.com/axios/axios/pull/10661"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
}
],
"release_date": "2026-04-09T14:31:46.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-4926",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-03-26T20:03:28.427630+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in `path-to-regexp` that can lead to a Denial of Service. The vulnerability occurs when specially crafted input containing multiple sequential optional groups is used to generate regular expressions, causing exponential resource consumption.\n\nThe Red Hat Advanced Cluster Security is not affected by this issue since it\u0027s shipping a `path-to-regexp` version which doesn\u0027t contain the vulnerable code.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "RHBZ#2451867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"release_date": "2026-03-26T18:59:38+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions"
},
{
"cve": "CVE-2026-22731",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-03-19T23:02:37.111109+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449290"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22731"
},
{
"category": "external",
"summary": "RHBZ#2449290",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449290"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-22731",
"url": "https://spring.io/security/cve-2026-22731"
}
],
"release_date": "2026-03-19T22:36:15.112000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate, ensure that application endpoints requiring authentication are not declared under paths already configured as Health Group additional paths within Spring Boot applications using Actuator. Review and adjust your application\u0027s configuration to prevent this overlap. A redeployment of the application is required for changes to take effect.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-26999",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T19:01:09.939098+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444874"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote unauthenticated client can exploit this vulnerability by sending an incomplete Transport Layer Security (TLS) record, which causes the TLS handshake to stall indefinitely. This can lead to resource exhaustion, such as file descriptors and goroutines, ultimately degrading the availability of all services on the affected entrypoint, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/traefik/traefik: Traefik: Denial of Service due to incomplete TLS handshake",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26999"
},
{
"category": "external",
"summary": "RHBZ#2444874",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444874"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26999"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26999",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26999"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v2.11.38",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.38"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.6.9",
"url": "https://github.com/traefik/traefik/releases/tag/v3.6.9"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/security/advisories/GHSA-xw98-5q62-jx94",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-xw98-5q62-jx94"
}
],
"release_date": "2026-03-05T16:15:36.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/traefik/traefik: Traefik: Denial of Service due to incomplete TLS handshake"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-27606",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-02-25T04:01:24.449922+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2442530"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability affecting Red Hat products that utilize the Rollup JavaScript module bundler. Insecure filename sanitization combined with unsafe path resolution allows an attacker to perform arbitrary file writes via path traversal. This enables the use of traversal sequences in output filenames, potentially leading to persistent Remote Code Execution by overwriting critical system or user configuration files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27606"
},
{
"category": "external",
"summary": "RHBZ#2442530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442530"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27606"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2",
"url": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e",
"url": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3",
"url": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v2.80.0",
"url": "https://github.com/rollup/rollup/releases/tag/v2.80.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v3.30.0",
"url": "https://github.com/rollup/rollup/releases/tag/v3.30.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/releases/tag/v4.59.0",
"url": "https://github.com/rollup/rollup/releases/tag/v4.59.0"
},
{
"category": "external",
"summary": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc",
"url": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc"
}
],
"release_date": "2026-02-25T02:08:06.682000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate the risk of arbitrary file writes and remote code execution, ensure that build processes utilizing the Rollup module bundler are executed within a strictly controlled and isolated environment, such as a container with minimal privileges. Restrict the file system permissions of the user or service account running Rollup to only the directories absolutely necessary for its operation. Additionally, rigorously validate all inputs, including CLI arguments, manual chunk aliases, and third-party plugins, to prevent the introduction of malicious path traversal sequences.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability"
},
{
"cve": "CVE-2026-29054",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-03-05T19:01:04.119334+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444872"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote unauthenticated client can exploit a case sensitivity vulnerability in how Traefik processes HTTP/1.1 requests. By using lowercase tokens in the Connection header, an attacker can bypass security protections, leading to the removal of Traefik-managed forwarded identity headers. This could result in information disclosure or misattribution of client requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/traefik/traefik: Traefik: Information disclosure due to case-insensitive Connection header processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29054"
},
{
"category": "external",
"summary": "RHBZ#2444872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444872"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29054",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29054"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29054",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29054"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v2.11.38",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.38"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.6.9",
"url": "https://github.com/traefik/traefik/releases/tag/v3.6.9"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/security/advisories/GHSA-92mv-8f8w-wq52",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-92mv-8f8w-wq52"
}
],
"release_date": "2026-03-05T16:18:49.230000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/traefik/traefik: Traefik: Information disclosure due to case-insensitive Connection header processing"
},
{
"cve": "CVE-2026-32305",
"cwe": {
"id": "CWE-179",
"name": "Incorrect Behavior Order: Early Validation"
},
"discovery_date": "2026-03-20T11:02:42.394091+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449595"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Traefik, an HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending fragmented ClientHello packets during the Transport Layer Security (TLS) handshake. This causes Traefik\u0027s Server Name Indication (SNI) extraction to fail, leading to a fallback to a default TLS configuration that does not require client certificates. This allows an attacker to bypass mutual TLS (mTLS) authentication, gaining unauthorized access to services that should be protected by client certificate requirements.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Traefik: github.com/traefik/traefik: Traefik: mTLS bypass allows unauthorized service access via fragmented ClientHello.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32305"
},
{
"category": "external",
"summary": "RHBZ#2449595",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449595"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32305",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32305"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32305",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32305"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v2.11.41",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.41"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.6.11",
"url": "https://github.com/traefik/traefik/releases/tag/v3.6.11"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2",
"url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48"
}
],
"release_date": "2026-03-20T10:01:13.620000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate unauthorized access, restrict network access to the Traefik instance to only trusted clients and networks. Implement firewall rules to limit inbound connections to the ports Traefik listens on for mTLS-protected services. For example, using `firewalld`, specific source IP addresses or networks can be allowed. After applying firewall rules, ensure the firewall service is reloaded for changes to take effect. This reduces the attack surface by preventing untrusted external access to the Traefik instance.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Traefik: github.com/traefik/traefik: Traefik: mTLS bypass allows unauthorized service access via fragmented ClientHello."
},
{
"cve": "CVE-2026-32695",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-03-27T14:01:07.317898+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452235"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When using the Knative provider, Traefik incorrectly interpolates user-controlled values into router rule expressions without proper escaping. This vulnerability allows an attacker to inject malicious rule syntax, leading to a host restriction bypass. In multi-tenant environments, this can result in unauthorized traffic being routed to victim services, potentially exposing cross-tenant traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32695"
},
{
"category": "external",
"summary": "RHBZ#2452235",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452235"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32695"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32695",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32695"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.6.11",
"url": "https://github.com/traefik/traefik/releases/tag/v3.6.11"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2",
"url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj"
}
],
"release_date": "2026-03-27T13:47:03.645000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33433",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2026-03-27T15:03:19.672851+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452289"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When the `headerField` is configured with a non-canonical HTTP header name, an authenticated attacker can inject a canonical version of that header. This allows the attacker to impersonate any identity to the backend, leading to an authentication bypass. The backend prioritizes the attacker-injected header, overriding Traefik\u0027s intended header.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/traefik/traefik: Traefik: Authentication bypass via non-canonical HTTP header injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33433"
},
{
"category": "external",
"summary": "RHBZ#2452289",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452289"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33433",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33433"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33433",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33433"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v2.11.42",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.42"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.6.11",
"url": "https://github.com/traefik/traefik/releases/tag/v3.6.11"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3",
"url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3"
},
{
"category": "external",
"summary": "https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c"
}
],
"release_date": "2026-03-27T13:49:08.455000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/traefik/traefik: Traefik: Authentication bypass via non-canonical HTTP header injection"
},
{
"cve": "CVE-2026-33805",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-15T11:00:57.611466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458651"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in @fastify/reply-from and @fastify/http-proxy. A remote attacker can exploit this vulnerability by manipulating the Connection header in client requests. This allows the attacker to remove specific headers that the proxy has added for security, routing, or access control purposes. Consequently, an attacker could bypass security mechanisms or gain unauthorized access to resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "@fastify/reply-from: @fastify/http-proxy: Fastify Reply From and HTTP Proxy: Security bypass via Connection header manipulation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important flaw exists in @fastify/reply-from and @fastify/http-proxy, allowing a remote attacker to bypass security, routing, or access control mechanisms. This is achieved by manipulating the Connection header in client requests, which can remove critical proxy-added headers. If reply-from or http-proxy are being used to add security relevant headers the attacker may be able to remove such information resulting in authentication bypass, privilege escalations or the possibility of jeopardize any further security control which depends on the removed request headers. This vulnerability have a high attack complexity rate as the attacker needs to intercept the communication between the client and the server to be able to manipulate the headers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33805"
},
{
"category": "external",
"summary": "RHBZ#2458651",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458651"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33805",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33805"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33805",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33805"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37",
"url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37"
}
],
"release_date": "2026-04-15T10:13:25.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "@fastify/reply-from: @fastify/http-proxy: Fastify Reply From and HTTP Proxy: Security bypass via Connection header manipulation"
},
{
"cve": "CVE-2026-33870",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-03-27T21:01:59.865839+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33870"
},
{
"category": "external",
"summary": "RHBZ#2452453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8",
"url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
"url": "https://w4ke.info/2025/06/18/funky-chunks.html"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/10/29/funky-chunks-2.html",
"url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc9110",
"url": "https://www.rfc-editor.org/rfc/rfc9110"
}
],
"release_date": "2026-03-27T19:54:15.586000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values"
},
{
"cve": "CVE-2026-33871",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-27T21:02:13.396015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452456"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server\u0027s lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This important vulnerability in Netty HTTP/2 servers allows a remote attacker to cause a Denial of Service by sending a flood of CONTINUATION frames. This can lead to excessive CPU consumption and render the server unresponsive. Red Hat products utilizing affected Netty versions, such as Red Hat AMQ, Enterprise Application Platform, and OpenShift Container Platform components, are impacted if configured to use HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33871"
},
{
"category": "external",
"summary": "RHBZ#2452456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
}
],
"release_date": "2026-03-27T19:55:23.135000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood"
},
{
"cve": "CVE-2026-33937",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-27T22:02:50.619819+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452523"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Handlebars. An attacker can exploit this by supplying a crafted Abstract Syntax Tree (AST) object to the `Handlebars.compile()` function. This allows the injection and execution of arbitrary JavaScript code due to improper sanitization of the `value` field in `NumberLiteral` AST nodes. This vulnerability can lead to Remote Code Execution (RCE) on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Handlebars that allows for Remote Code Execution. The flaw occurs when the `Handlebars.compile()` function processes a specially crafted Abstract Syntax Tree (AST) object, leading to the injection and execution of arbitrary JavaScript code. Red Hat products utilizing Handlebars are affected if they process untrusted input through the `compile()` function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33937"
},
{
"category": "external",
"summary": "RHBZ#2452523",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452523"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33937"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33937",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33937"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2",
"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9",
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q",
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q"
}
],
"release_date": "2026-03-27T21:03:46.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that any input provided to the `Handlebars.compile()` function is strictly validated to be a string type, preventing the injection of crafted Abstract Syntax Tree (AST) objects. Additionally, for deployments where templates are pre-compiled at build time, consider utilizing the Handlebars runtime-only build (`handlebars/runtime`). This build variant does not include the `compile()` function, thereby eliminating the attack vector. If the application is a service, a restart may be required for the changes to take effect.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile()"
},
{
"cve": "CVE-2026-33938",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-03-27T22:02:58.504001+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452525"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Handlebars. A remote attacker can exploit this vulnerability by manipulating the `@partial-block` special variable within the template data context. By overwriting `@partial-block` with a specially crafted Abstract Syntax Tree (AST) through a helper, a subsequent invocation of `{{\u003e @partial-block}}` will compile and execute the malicious AST. This enables arbitrary JavaScript execution on the server, leading to potential compromise of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "handlebars: Handlebars: Arbitrary code execution via @partial-block overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Handlebars allows arbitrary code execution when processing untrusted input. This occurs if an attacker can manipulate the `@partial-block` special variable through a helper, leading to the execution of a crafted Abstract Syntax Tree. Red Hat products are affected if they use Handlebars versions 4.0.0 through 4.7.8 in server-side applications where untrusted input can influence template data or context objects. Deployments utilizing the Handlebars runtime-only build are not vulnerable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33938"
},
{
"category": "external",
"summary": "RHBZ#2452525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452525"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33938",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33938"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33938",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33938"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2",
"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9",
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r",
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r"
}
],
"release_date": "2026-03-27T21:05:42.485000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Applications using Handlebars should implement the runtime-only build (`require(\u0027handlebars/runtime\u0027)`) to prevent exploitation, as this build lacks the vulnerable `compile()` method. Additionally, review all registered helpers to ensure they do not write arbitrary values to context objects, and avoid using third-party helpers in contexts exposed to untrusted input.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "handlebars: Handlebars: Arbitrary code execution via @partial-block overwrite"
},
{
"cve": "CVE-2026-33939",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-03-27T22:01:36.296267+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452508"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Handlebars.js. A remote attacker can exploit this by submitting a malformed Handlebars template that includes decorator syntax referencing an unregistered decorator. When the application attempts to compile this template without proper error handling, it triggers an unhandled `TypeError`. This error causes the Node.js process to crash, resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "handlebars.js: Handlebars.js: Denial of Service via malformed decorator syntax in template compilation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Handlebars.js affecting applications that compile user-supplied templates without proper error handling. A remote attacker can submit a malformed template containing unregistered decorator syntax, leading to an unhandled `TypeError` and crashing the Node.js process. Red Hat products are vulnerable if they use Handlebars.js in a configuration that allows untrusted input to be compiled at runtime without implementing `try/catch` blocks or input validation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33939"
},
{
"category": "external",
"summary": "RHBZ#2452508",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452508"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33939"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33939",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33939"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2",
"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9",
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff",
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff"
}
],
"release_date": "2026-03-27T21:08:24.664000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications utilizing Handlebars.js should implement robust error handling during template compilation and rendering. Specifically, wrap template compilation and rendering calls in `try/catch` blocks to gracefully handle `TypeError` exceptions. Alternatively, validate user-supplied template input to reject decorator syntax (`{{*...}}`) if decorators are not actively used by the application. Employing a pre-compilation workflow, where templates are compiled at build time and only pre-compiled templates are served, can also prevent runtime exploitation. If the application is a service, a restart may be required for changes to take effect.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "handlebars.js: Handlebars.js: Denial of Service via malformed decorator syntax in template compilation"
},
{
"cve": "CVE-2026-33940",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-27T22:02:42.813017+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452521"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Handlebars.js. A remote attacker can exploit this vulnerability by providing a specially crafted object within the template context. This crafted object, when processed by a dynamic partial lookup, can bypass security checks and be interpreted as malicious code. This allows the attacker to execute arbitrary commands on the server where Handlebars.js is running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important arbitrary code execution vulnerability in Handlebars.js. The flaw can be exploited when an application uses Handlebars.js with dynamic partial lookups and processes user-controlled data within the template context. Red Hat products bundling Handlebars.js are affected if they meet these specific conditions for exploitation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33940"
},
{
"category": "external",
"summary": "RHBZ#2452521",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452521"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33940"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33940",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33940"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2",
"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9",
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6",
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6"
}
],
"release_date": "2026-03-27T21:11:10.719000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate this issue, use the runtime-only build of Handlebars.js, which prevents the fallback compilation path from being reached. Alternatively, sanitize all context data before rendering to ensure no non-primitive objects are passed to dynamic partials. Avoid dynamic partial lookups (`{{\u003e (lookup ...)}}`) when context data is user-controlled. Implementing these mitigations may require application-level changes.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context"
},
{
"cve": "CVE-2026-33941",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-27T22:02:54.583022+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452524"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Handlebars. The Handlebars command-line interface (CLI) precompiler concatenates user-controlled strings, such as template file names and CLI options, directly into the generated JavaScript without proper escaping or sanitization. An attacker capable of influencing these inputs can inject arbitrary JavaScript code. This can lead to arbitrary code execution when the generated JavaScript bundle is loaded in a Node.js environment or a web browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "handlebars.js: Handlebars: Arbitrary code execution via CLI precompiler input sanitization flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Handlebars allows arbitrary code execution when the CLI precompiler processes untrusted inputs. An attacker who can influence template filenames or command-line arguments can inject malicious JavaScript, which executes when the generated bundle is loaded. Red Hat products utilizing the Handlebars CLI precompiler in environments where untrusted inputs are processed may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33941"
},
{
"category": "external",
"summary": "RHBZ#2452524",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452524"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33941"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33941",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33941"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2",
"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9",
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"
},
{
"category": "external",
"summary": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf",
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf"
}
],
"release_date": "2026-03-27T21:13:15.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure all inputs to the Handlebars CLI precompiler are thoroughly validated, rejecting characters with JavaScript string-escaping significance (e.g., \\\" , \\\u0027 , ;). For automated build pipelines, configure a fixed and trusted namespace string via a configuration file rather than passing it through command-line arguments. Additionally, consider running the precompiler within a sandboxed environment, such as a container with restricted write access, to limit the potential impact of successful exploitation.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "handlebars.js: Handlebars: Arbitrary code execution via CLI precompiler input sanitization flaw"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important impact denial of service vulnerability in the Go JOSE library can be triggered by a crafted JSON Web Encryption (JWE) object specifying a key wrapping algorithm with an empty encrypted_key field, causing a panic and application crash. Applications that parse and decrypt JWE objects from untrusted sources are affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40175",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-10T20:02:10.296601+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40175"
},
{
"category": "external",
"summary": "RHBZ#2457432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/pull/10660",
"url": "https://github.com/axios/axios/pull/10660"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
"url": "https://github.com/axios/axios/releases/tag/v1.15.0"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
}
],
"release_date": "2026-04-10T19:23:52.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-23T14:43:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:56cb90d67267ebd08bdfda825c0a00c7ffea666ceab68f50892420c04c393cfd_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:6ced7da0ea3bd692379aff9f94c54c7593841a15913ac499de3af20b092db729_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:ab17ccae17238a74cafd6fdd33263f5c882ae15cbc81dfb02723694a7c360ce1_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-rhel9@sha256:baccc8bb116ef4d28dab809f404bdf5e45c2e55322ba1460da358c514f5cf2a5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:215497f67b822c565fa6768950a94ba03379d772f67ad17e27721094c4d10ffa_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:45b9dab6a3009aeb058509314d216b8a100962d8a191ad0e10b317652425dcfc_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:70cca9c1fe458d00f4cf7735ed87b070d12060110d93abf0dbd85150e89a2d66_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:f7d3433f5dcaca8469c987c43cdd6e61477f0197088f9fff043d36dd5e81b89f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:24a3b1ec2d7d0550c64845b92f19b2edfadb27dcebbe1c97f18b99304f872b4e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:59c9346bf39f7ccda10b4859c7e97d618f0e8304fb4b00cc43f89889784f2dde_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:977f8f7267f8d125ceceb83842ab4a694a7f9f9b128fd18cd95a563268d00ea1_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/configbump-rhel9@sha256:cb03babff3a4a782254c6ccf6552e92c8569f79492cc181fc99e6912c1feb6e9_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:13738c2b11bdbfe22d91bb0621a501c0c1ab87b9b386d42b7ae113ffd8d323ff_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:25dbcc4a7decb9c274715c585d61a6caf3baa5d48258377ac364eae20a51d2c6_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:339aa11adcbee1feadc4d56961f5dabd61790c92914ea11161a6573bdef8822e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/dashboard-rhel9@sha256:633f8dde6d1247cbccacac6cd7b96c6072c8324d80f0975bcd758fb8a3a30615_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:961edfa27ff733d7579fa404afc736fbf2a06b9925afa21117cce72df5fae379_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:1b352d90ac53831bc57791941f2599aeaed1ae8ed20f9d3741bc6437280dd6a2_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:b725dd7c6820096309e8ae1bdce5c04c273dba3087a45f077c332bb255e58a17_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:d05c45444879964a4967b859bf350cb0af320636b752b87aed2e89439ecb20c6_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dcb526cfbfab7edfdad8f75e572f3ce9a2620599efb1b47a306bb9e39eb9ae0d_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:3bc28b9aad6ba4d8c9d29b909aa7031ec610f9faec927111434d7d93dacc511e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:6b3e4729274a6d9b8056c806cbd85d8cc5009df5212d506a09f7d5520bb61dac_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:926b1e278e1e4f5e3ac9bb48b363b52fb4828b63d652e75feffa25a5c4803843_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d3dcc6ef11235469669ea0398824060cda322cfc2dc2f36a481e6de8d41b926f_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:4008a58bf876fe38017bfad1b7cbb5510d5e919600d1b59d439b8faadc336932_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:7e061e4d402706fbad01d755aee25b636e05d47ddf6badd28b6ed799122262fd_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:de2b07f33ed8acdee2c312c08961a71629477329b9212edf8f95a00ab46f0418_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:f72fca1d67a2faefbbe4725614be7d10df4b91b18d34e744d71a97f27376dce5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1d3a53c6688db4d8f8ff853003c96de2fb4d88c6274c2b32d3002eefb64d48d8_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:4065b1d8a2e685fe4e0710dc55670ec7f5b189d09331f036e3cbf69929b2d38d_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:5df884a70037f56dc852b4f4ec8a6e49ddea327c5c744d5bf21b3dcf0634bc45_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:7933cd708f57493d33d32620fa888856b714c343572cf5e84fa80b3bdb1e990a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:12650f16ec1d9a079736da2d7e7428c791ae9a105bc0237814b9a2edd9f9a0ae_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b2ccfa151d86315f1973d9cbfb1d3564e9daea8e4eac04e6f7b9e06f4521fcde_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:bf8c28c1dbed78077a84baf2d43bb0119c37a088a480121395aefcceb89b066e_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/openvsx-rhel9@sha256:d0882e222cea223cd64110ecfdf6dfdbe4faa7526c31293d304367bf9bb6f16c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:27e30c7cede8d846cac4c623e84c6791a64b918136c5b781e9e885139fe237fb_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e224aebfad7c18649dfba4361bc0a77e937da1e69c230efa25ea2f6e1f9b17c2_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:e832fb5a60f8a5180462458de7f410d01d8423473c4501b1b2e64ee606cb19b5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fb7eb298c502721c2dc77cf25d073681b9e5a4d6a7f5b1107f70bb8f787d273d_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:57b73c1ca124517557ba4b054c6367f0c045f588ec03a41e97184907562ca4e4_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:7ba3f74dd8f72ea794da3073340c12377551aa77094c5c48ba2011e8fb8170dc_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:88bedfc47deb5194aa15c18880111e810768428621168877a6316d394e1d8297_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/server-rhel9@sha256:d97641f5881f1210f5ec6a95129cd99f232d24ee3e9eee2b3ad74a9eecf429ca_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:179efd9379165b0e7992d0cca5e2c94cb25412153ea333e4c01d693bf64ad736_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:34f8243809fb492094eb221362addaa91ab8d2dd9f233383328b695bc1f559c4_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:cbf71be94cfa5f2eaee079395261f3130b8857f38f210f5732280d30a792492c_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/traefik-rhel9@sha256:ee3f68c28619e2af980739a351305c843d0ebb8bc98bda61e77cfabbb2e11641_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:02d89848ea471688663827250f824a48af4e29bf7c0cd4713182f234df48826a_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:8e1683ff5b33202e909ab53a9adc5b86997d25d33f8e1063083914e5189540f1_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e1dbd1f05eda40b0a87e7ea1d9f0ca59dde6a51981c0b9efba5f2e5512b323e5_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel10@sha256:e6a901d3572a786dcee22b4d7a80547cbfe8cb2dba212e2f9e76a1bc897caa9c_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:08f1525029ca83ecc0c44129d6dc5902af62043b5ef3779f8d91d6b603427aa3_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:17a4a50ceb0a87dfab7ae88d04f0dca528af15b15c45b04f44e631a6ffdab420_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:9d1263ca381ca4a9e320baf7694c530ddbf21685b9cdefc6717e833c9876d26e_s390x",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-base-rhel9@sha256:b65e3d437cb6f5a9c14b94f0f8e1b19260e740a9bdaa2655a1641c8dd4bb67e5_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:0c7e182dc31c12b24b589224202b3231e400367dda68fa5b670a60219d1ee0ae_amd64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:44aa34d856b0d25407327ba3c0a29f45543976a4500093a589998dc846a6c88f_arm64",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:6bea432af6f2d9217fd722326d5c5ca00d205d98f386bd1d23aa1abadda7814c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.27:registry.redhat.io/devspaces/udi-rhel9@sha256:7c510843d926a2de666d22edf9edbefaa0025d5e2a002c6519d79fa820a1faa1_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
}
]
}
RHSA-2026:14272
Vulnerability from csaf_redhat - Published: 2026-05-06 17:58 - Updated: 2026-09-10 11:16Summary
Red Hat Security Advisory: Red Hat AMQ Broker 7.13.5 release and security update
Severity
Important
Notes
Topic: Red Hat AMQ Broker 7.13.5 is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.
This release of Red Hat AMQ Broker 7.13.5 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* (CVE-2025-14813) bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly
* (CVE-2026-0636) bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java
* (CVE-2026-24281) zookeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing
* (CVE-2026-24308) zookeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
* (CVE-2026-33870) netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values
* (CVE-2026-33871) netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood
* (CVE-2026-5588) bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache ZooKeeper. The ZKTrustManager component's hostname verification process can fall back to reverse DNS (PTR) lookup when IP Subject Alternative Name (SAN) validation fails. This vulnerability allows an attacker who can control or spoof PTR records to impersonate ZooKeeper servers or clients, provided they possess a valid certificate for the PTR name. This could lead to unauthorized access or manipulation of ZooKeeper services.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client's logfile. This vulnerability can lead to information disclosure, potentially revealing critical system details to unauthorized parties.
CWE-117 - Improper Output Neutralization for LogsAffected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ Broker 7.13.5
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7.13
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
58 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AMQ Broker 7.13.5 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.\n\nThis release of Red Hat AMQ Broker 7.13.5 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* (CVE-2025-14813) bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly\n* (CVE-2026-0636) bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java\n* (CVE-2026-24281) zookeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing\n* (CVE-2026-24308) zookeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values\n* (CVE-2026-33870) netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values\n* (CVE-2026-33871) netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood\n* (CVE-2026-5588) bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:14272",
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification#important",
"url": "https://access.redhat.com/security/updates/classification#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.13.5",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.13.5"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_amq_broker/7.13",
"url": "https://docs.redhat.com/en/documentation/red_hat_amq_broker/7.13"
},
{
"category": "external",
"summary": "2445449",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445449"
},
{
"category": "external",
"summary": "2445451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445451"
},
{
"category": "external",
"summary": "2452453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
},
{
"category": "external",
"summary": "2452456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
},
{
"category": "external",
"summary": "2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14272.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AMQ Broker 7.13.5 release and security update",
"tracking": {
"current_release_date": "2026-09-10T11:16:16+00:00",
"generator": {
"date": "2026-09-10T11:16:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:14272",
"initial_release_date": "2026-05-06T17:58:57+00:00",
"revision_history": [
{
"date": "2026-05-06T17:58:57+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-06T17:58:57+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T11:16:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AMQ Broker 7.13.5",
"product": {
"name": "Red Hat AMQ Broker 7.13.5",
"product_id": "Red Hat AMQ Broker 7.13.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:amq_broker:7.13"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss AMQ"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-24281",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-07T09:00:57.868082+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445449"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ZooKeeper. The ZKTrustManager component\u0027s hostname verification process can fall back to reverse DNS (PTR) lookup when IP Subject Alternative Name (SAN) validation fails. This vulnerability allows an attacker who can control or spoof PTR records to impersonate ZooKeeper servers or clients, provided they possess a valid certificate for the PTR name. This could lead to unauthorized access or manipulation of ZooKeeper services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24281"
},
{
"category": "external",
"summary": "RHBZ#2445449",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445449"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24281"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2",
"url": "https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2"
}
],
"release_date": "2026-03-07T08:50:32.525000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable reverse DNS lookup in Apache ZooKeeper\u0027s client and quorum protocols. This can be achieved by configuring the `zookeeper.ssl.hostnameVerification.disableReverseDns` property to `true`. This configuration option is available in Apache ZooKeeper versions 3.8.6 and 3.9.5 and later. A restart of the ZooKeeper service will be required for the change to take effect.",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing"
},
{
"cve": "CVE-2026-24308",
"cwe": {
"id": "CWE-117",
"name": "Improper Output Neutralization for Logs"
},
"discovery_date": "2026-03-07T09:01:03.859129+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445451"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client\u0027s logfile. This vulnerability can lead to information disclosure, potentially revealing critical system details to unauthorized parties.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24308"
},
{
"category": "external",
"summary": "RHBZ#2445451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445451"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24308"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24308",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24308"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr",
"url": "https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr"
}
],
"release_date": "2026-03-07T08:51:17.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values"
},
{
"cve": "CVE-2026-33870",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-03-27T21:01:59.865839+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33870"
},
{
"category": "external",
"summary": "RHBZ#2452453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8",
"url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
"url": "https://w4ke.info/2025/06/18/funky-chunks.html"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/10/29/funky-chunks-2.html",
"url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc9110",
"url": "https://www.rfc-editor.org/rfc/rfc9110"
}
],
"release_date": "2026-03-27T19:54:15.586000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values"
},
{
"cve": "CVE-2026-33871",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-27T21:02:13.396015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452456"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server\u0027s lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This important vulnerability in Netty HTTP/2 servers allows a remote attacker to cause a Denial of Service by sending a flood of CONTINUATION frames. This can lead to excessive CPU consumption and render the server unresponsive. Red Hat products utilizing affected Netty versions, such as Red Hat AMQ, Enterprise Application Platform, and OpenShift Container Platform components, are impacted if configured to use HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ Broker 7.13.5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33871"
},
{
"category": "external",
"summary": "RHBZ#2452456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
}
],
"release_date": "2026-03-27T19:55:23.135000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T17:58:57+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ Broker 7.13.5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AMQ Broker 7.13.5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood"
}
]
}
RHSA-2026:17668
Vulnerability from csaf_redhat - Published: 2026-05-14 16:55 - Updated: 2026-09-10 11:16Summary
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.
Severity
Critical
Notes
Topic: Red Hat build of Apache Camel 4.18.1 for Spring Boot patch release and security update is now available.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
Details: Red Hat build of Apache Camel 4.18.1 for Spring Boot patch release and security update is now available.
The purpose of this text-only errata is to inform you about the security issues fixed.
Security Fix(es):
* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)
* spring-boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path (CVE-2026-22731)
* plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)
* netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870)
* netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)
* netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)
* jetty-ee10-annotations: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)
* jetty-ee10-apache-jsp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)
* jetty-ee10-plus: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)
* jetty-ee10-servlet: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)
* jetty-ee10-servlets: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)
* jetty-ee10-webapp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)
* kafka-clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management (CVE-2026-35554)
* camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization (CVE-2026-6857)
* bcprov-debug-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcprov-lts8on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* bcprov-debug-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* bcprov-lts8on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
* spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. (CVE-2026-40975)
* camel-mail: Camel-Mail: Altered application behavior via header injection (CVE-2026-33454)
* camel-jms: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)
* camel-google-pubsub: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)
* camel-http: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)
* camel-http-base: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)
* camel-http-common: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)
* camel-http-starter: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)
* camel-jms: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage (CVE-2026-40860)
* camel-amqp: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage (CVE-2026-40860)
* camel-http-base: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)
* camel-http-common: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)
* camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)
* camel-http-starter: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)
* camel-infinispan-common: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data (CVE-2026-40858)
* camel-infinispan-embedded: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data (CVE-2026-40858)
* camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data (CVE-2026-40858)
* mina-core: Apache MINA: Arbitrary code execution via classname allowlist bypass (CVE-2026-41635)
* spring-boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison (CVE-2026-40972)
* camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection (CVE-2026-33453)
* jetty-http: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)
* spring-boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory (CVE-2026-40973)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The `JASPIAuthenticator` class is responsible for handling authentication checks. During these checks, the class sets two ThreadLocal variables to store authentication state. Under certain conditions, the authentication process can return early without properly clearing the ThreadLocal variables, allowing a subsequent request to inherit the un-cleared ThreadLocal values. This issue can cause broken access control, authentication bypass, privilege escalation and data breaches.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Camel's camel-coap component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted CoAP (Constrained Application Protocol) UDP (User Datagram Protocol) packet. The camel-coap component improperly processes URI query parameters, allowing the attacker to inject arbitrary internal Camel message headers. If the Camel route forwards these messages to a header-sensitive producer, such as camel-exec, it can lead to arbitrary operating system command execution with the privileges of the Camel process, providing an interactive remote code execution channel.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the Camel-Mail component. An attacker can exploit this by sending a specially crafted email to a mailbox monitored by a Camel application. Due to a missing inbound filter, malicious headers within the email are not properly filtered, allowing them to alter the behavior of other components within the Camel application. This could lead to unintended actions or data manipulation.
9.4 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Critical
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer deallocation and potential reuse by other messages. Consequently, sensitive data may be exposed to unauthorized consumers, and data integrity can be compromised through deserialization failures and processing errors.
6.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Apache Camel embedded HTTP server and embedded management server (camel-platform-http-main). When authentication is enabled and a non-root context path is configured, the authentication handler incorrectly matches only the exact configured path, not its subpaths. This allows a remote, unauthenticated attacker to bypass authentication and access protected business routes and management endpoints. Specifically, the `/observe/info` endpoint can disclose sensitive runtime metadata, including user, working directory, process ID, and operating system information.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Apache Camel. A remote attacker with Java Message Service (JMS) producer access could exploit a vulnerability in how certain header filter strategies process case-variant internal headers. This discrepancy, where filtering is case-sensitive but header processing is not, allows for the injection of malicious headers. Consequently, this could lead to remote code execution and arbitrary file write on affected Camel routes.
9.9 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Critical
A flaw was found in the camel-infinispan component of Apache Camel. A remote attacker, with the ability to write to the Infinispan cache, can inject a specially crafted serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitrary code execution within the application. This vulnerability stems from the component's use of java.io.ObjectInputStream without proper input filtering.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service (JMS) ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message payload without proper validation. Successful exploitation could lead to remote code execution on the system consuming the message, provided a deserialization gadget chain is present on the classpath.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to remote code execution in the remote application.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Spring Boot. A local attacker on the same host as the application may be able to take control of the `ApplicationTemp` directory due to predictable temporary directory handling. When the `server.servlet.session.persistent` setting is enabled and the attack persists across application restarts, this could allow the attacker to read session information, hijack authenticated user sessions, or execute arbitrary code as the application's user.
7.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Spring Boot. The `${random.value}` property source utilizes a weak pseudo-random number generator (PRNG), meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information disclosure or a security bypass if they are used in sensitive applications.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Spring Boot when an application is configured to use `ApplicationPidFileWriter`. A local attacker with write access to the PID file's location can exploit this vulnerability to corrupt one arbitrary file on the host each time the application is started. This can lead to data integrity issues or a denial of service (DoS) by rendering critical system files unusable.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
References
157 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of Apache Camel 4.18.1 for Spring Boot patch release and security update is now available.\n\nRed Hat Product Security has rated this update as having a security impact of\nImportant. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Apache Camel 4.18.1 for Spring Boot patch release and security update is now available.\n\nThe purpose of this text-only errata is to inform you about the security issues fixed.\n\nSecurity Fix(es):\n\n* artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446)\n\n* spring-boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path (CVE-2026-22731)\n \n* plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)\n\n* netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870)\n\n* netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)\n\n* netty-codec-http2: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)\n\n* jetty-ee10-annotations: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)\n\n* jetty-ee10-apache-jsp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)\n\n* jetty-ee10-plus: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)\n\n* jetty-ee10-servlet: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)\n\n* jetty-ee10-servlets: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)\n\n* jetty-ee10-webapp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables (CVE-2026-5795)\n\n* kafka-clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management (CVE-2026-35554)\n\n* camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization (CVE-2026-6857)\n\n* bcprov-debug-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcprov-lts8on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)\n\n* bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n\n* bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)\n\n* bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)\n\n* bcprov-debug-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* bcprov-lts8on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)\n\n* spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. (CVE-2026-40975)\n\n* camel-mail: Camel-Mail: Altered application behavior via header injection (CVE-2026-33454)\n\n* camel-jms: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)\n\n* camel-google-pubsub: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)\n\n* camel-http: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)\n\n* camel-http-base: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)\n\n* camel-http-common: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)\n\n* camel-http-starter: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection (CVE-2026-40453)\n\n* camel-jms: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage (CVE-2026-40860)\n\n* camel-amqp: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage (CVE-2026-40860)\n\n* camel-http-base: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)\n\n* camel-http-common: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)\n\n* camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)\n\n* camel-http-starter: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers (CVE-2026-40022)\n\n* camel-infinispan-common: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data (CVE-2026-40858)\n\n* camel-infinispan-embedded: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data (CVE-2026-40858)\n\n* camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data (CVE-2026-40858)\n\n* mina-core: Apache MINA: Arbitrary code execution via classname allowlist bypass (CVE-2026-41635)\n\n* spring-boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison (CVE-2026-40972)\n\n* camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection (CVE-2026-33453)\n\n* jetty-http: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)\n\n* spring-boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory (CVE-2026-40973)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:17668",
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "2449290",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449290"
},
{
"category": "external",
"summary": "2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "2452453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
},
{
"category": "external",
"summary": "2452456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
},
{
"category": "external",
"summary": "2455916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455916"
},
{
"category": "external",
"summary": "2456519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456519"
},
{
"category": "external",
"summary": "2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "2460003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460003"
},
{
"category": "external",
"summary": "2463172",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463172"
},
{
"category": "external",
"summary": "2463173",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463173"
},
{
"category": "external",
"summary": "2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "2463178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463178"
},
{
"category": "external",
"summary": "2463179",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463179"
},
{
"category": "external",
"summary": "2463181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463181"
},
{
"category": "external",
"summary": "2463184",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463184"
},
{
"category": "external",
"summary": "2463330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463330"
},
{
"category": "external",
"summary": "2463331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463331"
},
{
"category": "external",
"summary": "2463332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463332"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17668.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.",
"tracking": {
"current_release_date": "2026-09-10T11:16:19+00:00",
"generator": {
"date": "2026-09-10T11:16:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:17668",
"initial_release_date": "2026-05-14T16:55:24+00:00",
"revision_history": [
{
"date": "2026-05-14T16:55:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-14T16:55:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T11:16:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"product": {
"name": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"product_id": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_spring_boot:4.18"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-5795",
"cwe": {
"id": "CWE-226",
"name": "Sensitive Information in Resource Not Removed Before Reuse"
},
"discovery_date": "2026-04-08T14:01:02.911884+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456519"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The `JASPIAuthenticator` class is responsible for handling authentication checks. During these checks, the class sets two ThreadLocal variables to store authentication state. Under certain conditions, the authentication process can return early without properly clearing the ThreadLocal variables, allowing a subsequent request to inherit the un-cleared ThreadLocal values. This issue can cause broken access control, authentication bypass, privilege escalation and data breaches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is only exploitable when `JASPIAuthenticator` class returns early and a subsequent request inherits the un-cleared ThreadLocal values. This requires a new request to be assigned the exact same recycled thread, increasing the complexity of exploitation. Due to these reasons, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5795"
},
{
"category": "external",
"summary": "RHBZ#2456519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456519"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5795"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-gc59-r5jq-98qw",
"url": "https://github.com/advisories/GHSA-gc59-r5jq-98qw"
}
],
"release_date": "2026-04-08T13:32:28.935000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables"
},
{
"acknowledgments": [
{
"names": [
"Feng Ning"
],
"organization": "Innora Pte. Ltd."
}
],
"cve": "CVE-2026-6857",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has an Important impact on Red Hat products utilizing `camel-infinispan` for remote aggregation. The flaw stems from unsafe deserialization within the ProtoStream remote aggregation repository, which could lead to remote code execution. This affects Red Hat Enterprise Application Platform and Red Hat JBoss Fuse when configured to use `camel-infinispan`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6857"
},
{
"category": "external",
"summary": "RHBZ#2460003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6857"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6857",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6857"
}
],
"release_date": "2026-04-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization"
},
{
"cve": "CVE-2026-22731",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-03-19T23:02:37.111109+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449290"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22731"
},
{
"category": "external",
"summary": "RHBZ#2449290",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449290"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-22731",
"url": "https://spring.io/security/cve-2026-22731"
}
],
"release_date": "2026-03-19T22:36:15.112000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate, ensure that application endpoints requiring authentication are not declared under paths already configured as Health Group additional paths within Spring Boot applications using Actuator. Review and adjust your application\u0027s configuration to prevent this overlap. A redeployment of the application is required for changes to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path"
},
{
"cve": "CVE-2026-27446",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-03-04T07:02:26.064000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444320"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as IMPORTANT severity because it does not enable remote code execution or system compromise (arbitrary code execution), which is Red Hat\u0027s threshold for Critical impact. Its impact is limited to message injection and exfiltration via rogue broker federation. Exploitation requires the broker to accept inbound Core protocol connections from untrusted networks with outbound connectivity to attacker-controlled systems. Availability impact is set to None as exploitation does not cause service disruption or broker instability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27446"
},
{
"category": "external",
"summary": "RHBZ#2444320",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27446"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27446"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg",
"url": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg"
}
],
"release_date": "2026-03-04T06:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict Core protocol support on acceptors receiving connections from untrusted sources. The default \"artemis\" acceptor on port 61616 supports all protocols, including Core. Modify the acceptor URL to explicitly exclude the Core protocol using the \"protocols\" URL parameter. Alternatively, configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for changes to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication"
},
{
"cve": "CVE-2026-33453",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-27T11:01:08.808664+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463184"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel\u0027s camel-coap component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted CoAP (Constrained Application Protocol) UDP (User Datagram Protocol) packet. The camel-coap component improperly processes URI query parameters, allowing the attacker to inject arbitrary internal Camel message headers. If the Camel route forwards these messages to a header-sensitive producer, such as camel-exec, it can lead to arbitrary operating system command execution with the privileges of the Camel process, providing an interactive remote code execution channel.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33453"
},
{
"category": "external",
"summary": "RHBZ#2463184",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463184"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33453"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-33453.html",
"url": "https://camel.apache.org/security/CVE-2026-33453.html"
}
],
"release_date": "2026-04-27T09:58:48.787000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection"
},
{
"cve": "CVE-2026-33454",
"cwe": {
"id": "CWE-1173",
"name": "Improper Use of Validation Framework"
},
"discovery_date": "2026-04-27T10:01:41.829738+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463181"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Camel-Mail component. An attacker can exploit this by sending a specially crafted email to a mailbox monitored by a Camel application. Due to a missing inbound filter, malicious headers within the email are not properly filtered, allowing them to alter the behavior of other components within the Camel application. This could lead to unintended actions or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Camel: Camel-Mail: Camel-Mail: Altered application behavior via header injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33454"
},
{
"category": "external",
"summary": "RHBZ#2463181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463181"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33454"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33454",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33454"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-33454.html",
"url": "https://camel.apache.org/security/CVE-2026-33454.html"
}
],
"release_date": "2026-04-27T09:42:39.799000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "Apache Camel: Camel-Mail: Camel-Mail: Altered application behavior via header injection"
},
{
"cve": "CVE-2026-33870",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-03-27T21:01:59.865839+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33870"
},
{
"category": "external",
"summary": "RHBZ#2452453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8",
"url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/06/18/funky-chunks.html",
"url": "https://w4ke.info/2025/06/18/funky-chunks.html"
},
{
"category": "external",
"summary": "https://w4ke.info/2025/10/29/funky-chunks-2.html",
"url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc9110",
"url": "https://www.rfc-editor.org/rfc/rfc9110"
}
],
"release_date": "2026-03-27T19:54:15.586000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values"
},
{
"cve": "CVE-2026-33871",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-27T21:02:13.396015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452456"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server\u0027s lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume excessive CPU resources. This can render the server unresponsive with minimal bandwidth usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This important vulnerability in Netty HTTP/2 servers allows a remote attacker to cause a Denial of Service by sending a flood of CONTINUATION frames. This can lead to excessive CPU consumption and render the server unresponsive. Red Hat products utilizing affected Netty versions, such as Red Hat AMQ, Enterprise Application Platform, and OpenShift Container Platform components, are impacted if configured to use HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33871"
},
{
"category": "external",
"summary": "RHBZ#2452456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452456"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
}
],
"release_date": "2026-03-27T19:55:23.135000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood"
},
{
"cve": "CVE-2026-35554",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-07T14:01:09.792155+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455916"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Kafka Java producer client. A race condition in the client\u0027s buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer deallocation and potential reuse by other messages. Consequently, sensitive data may be exposed to unauthorized consumers, and data integrity can be compromised through deserialization failures and processing errors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35554"
},
{
"category": "external",
"summary": "RHBZ#2455916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35554"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35554",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35554"
},
{
"category": "external",
"summary": "https://issues.apache.org/jira/browse/KAFKA-19012",
"url": "https://issues.apache.org/jira/browse/KAFKA-19012"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6",
"url": "https://lists.apache.org/thread/f07x7j8ovyqhjd1to25jsnqbm6wj01d6"
}
],
"release_date": "2026-04-07T13:07:08.679000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management"
},
{
"cve": "CVE-2026-40022",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-04-27T10:01:32.316756+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463178"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Camel embedded HTTP server and embedded management server (camel-platform-http-main). When authentication is enabled and a non-root context path is configured, the authentication handler incorrectly matches only the exact configured path, not its subpaths. This allows a remote, unauthenticated attacker to bypass authentication and access protected business routes and management endpoints. Specifically, the `/observe/info` endpoint can disclose sensitive runtime metadata, including user, working directory, process ID, and operating system information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40022"
},
{
"category": "external",
"summary": "RHBZ#2463178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463178"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40022"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40022",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40022"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/26/5",
"url": "http://www.openwall.com/lists/oss-security/2026/04/26/5"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-40022.html",
"url": "https://camel.apache.org/security/CVE-2026-40022.html"
}
],
"release_date": "2026-04-27T09:40:28.107000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers"
},
{
"cve": "CVE-2026-40453",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-04-27T10:01:14.347755+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463173"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel. A remote attacker with Java Message Service (JMS) producer access could exploit a vulnerability in how certain header filter strategies process case-variant internal headers. This discrepancy, where filtering is case-sensitive but header processing is not, allows for the injection of malicious headers. Consequently, this could lead to remote code execution and arbitrary file write on affected Camel routes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Camel: org.apache.camel: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Critical flaw in Apache Camel allows remote code execution and arbitrary file write. An attacker with Java Message Service (JMS) producer access can exploit a discrepancy in header processing, where case-variant internal headers are filtered case-sensitively but processed case-insensitively. This enables the injection of malicious headers into Camel routes that forward JMS messages to header-driven components, posing a significant risk to affected Red Hat products.\n\nThe critical severity is tied to the low complexity and low privileges required by the attack to exploit this vulnerability, this flaw also differs from the CVE-2025-27636 in the fact that an attacker may leverage this flaw to execute code that are beyond the methods already in the classpath meaning the impact for Integrity, Availability and Confidentiality is higher for this CVE and the impact scope may go beyond of only Apache Camel component but can impact the whole server hosting it.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40453"
},
{
"category": "external",
"summary": "RHBZ#2463173",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463173"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40453"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-40453.html",
"url": "https://camel.apache.org/security/CVE-2026-40453.html"
}
],
"release_date": "2026-04-27T08:23:20.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "This flaw may be mitigated by temporarily disabling routes that allows arbitrary writes and executions (camel-exec and camel-file)",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "Apache Camel: org.apache.camel: Apache Camel: Remote Code Execution and Arbitrary File Write via case-variant header injection"
},
{
"cve": "CVE-2026-40858",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:35.538625+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463179"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the camel-infinispan component of Apache Camel. A remote attacker, with the ability to write to the Infinispan cache, can inject a specially crafted serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitrary code execution within the application. This vulnerability stems from the component\u0027s use of java.io.ObjectInputStream without proper input filtering.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40858"
},
{
"category": "external",
"summary": "RHBZ#2463179",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463179"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40858"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40858",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40858"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-40858.html",
"url": "https://camel.apache.org/security/CVE-2026-40858.html"
}
],
"release_date": "2026-04-27T09:38:55.466000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data"
},
{
"cve": "CVE-2026-40860",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:11.044535+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463172"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service (JMS) ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message payload without proper validation. Successful exploitation could lead to remote code execution on the system consuming the message, provided a deserialization gadget chain is present on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40860"
},
{
"category": "external",
"summary": "RHBZ#2463172",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463172"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40860"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/26/10",
"url": "http://www.openwall.com/lists/oss-security/2026/04/26/10"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-40860.html",
"url": "https://camel.apache.org/security/CVE-2026-40860.html"
}
],
"release_date": "2026-04-27T08:03:19.616000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage"
},
{
"cve": "CVE-2026-40972",
"cwe": {
"id": "CWE-208",
"name": "Observable Timing Discrepancy"
},
"discovery_date": "2026-04-28T00:02:02.075124+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to remote code execution in the remote application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40972"
},
{
"category": "external",
"summary": "RHBZ#2463332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40972"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40972",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40972"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40972",
"url": "https://spring.io/security/cve-2026-40972"
}
],
"release_date": "2026-04-27T23:15:19.194000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the Spring Boot DevTools remote functionality in production environments. This feature is primarily intended for development and should not be enabled in publicly accessible deployments.\n\nTo disable remote DevTools, ensure the `spring.devtools.remote.secret` property is not configured, or explicitly set `spring.devtools.remote.enabled=false` in your application\u0027s `application.properties` or `application.yml` file.\n\nExample for `application.properties`:\n`spring.devtools.remote.enabled=false`\n\nDisabling this feature may impact development workflows that rely on remote DevTools capabilities. A restart of the application is required for the changes to take effect.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison"
},
{
"cve": "CVE-2026-40973",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-04-28T00:01:55.408040+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. A local attacker on the same host as the application may be able to take control of the `ApplicationTemp` directory due to predictable temporary directory handling. When the `server.servlet.session.persistent` setting is enabled and the attack persists across application restarts, this could allow the attacker to read session information, hijack authenticated user sessions, or execute arbitrary code as the application\u0027s user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40973"
},
{
"category": "external",
"summary": "RHBZ#2463330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40973",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40973"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40973",
"url": "https://spring.io/security/cve-2026-40973"
}
],
"release_date": "2026-04-27T23:29:51.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the `server.servlet.session.persistent` property is set to `false` in your Spring Boot application\u0027s configuration. This prevents session information from being written to the predictable temporary directory, thereby removing the conditions necessary for exploitation. Disabling persistent sessions may affect application behavior that relies on session data surviving restarts.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory"
},
{
"cve": "CVE-2026-40975",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-04-28T00:01:58.716976+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. The `${random.value}` property source utilizes a weak pseudo-random number generator (PRNG), meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information disclosure or a security bypass if they are used in sensitive applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40975"
},
{
"category": "external",
"summary": "RHBZ#2463331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40975"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40975",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40975"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40975",
"url": "https://spring.io/security/cve-2026-40975"
}
],
"release_date": "2026-04-27T23:32:58.596000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"category": "workaround",
"details": "Applications utilizing Spring Boot should avoid using the `${random.value}` property for generating cryptographic secrets or other security-sensitive data. Developers should review their application configurations and code to ensure that only cryptographically strong random number generators are used for such purposes. For UUID generation, `${random.uuid}` is not affected and can be used.",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure."
},
{
"cve": "CVE-2026-40977",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-04-28T00:01:51.999219+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot when an application is configured to use `ApplicationPidFileWriter`. A local attacker with write access to the PID file\u0027s location can exploit this vulnerability to corrupt one arbitrary file on the host each time the application is started. This can lead to data integrity issues or a denial of service (DoS) by rendering critical system files unusable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Local file corruption via PID file manipulation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40977"
},
{
"category": "external",
"summary": "RHBZ#2463329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40977"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40977",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40977"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40977",
"url": "https://spring.io/security/cve-2026-40977"
}
],
"release_date": "2026-04-27T23:36:06.654000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Local file corruption via PID file manipulation"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-14T16:55:24+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
}
]
}
RHSA-2026:20568
Vulnerability from csaf_redhat - Published: 2026-05-26 01:50 - Updated: 2026-09-09 22:58Summary
Red Hat Security Advisory: jmc security update
Severity
Important
Notes
Topic: An update for jmc is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis of the extensive data collected by JDK Flight Recorder. The tool chain enables developers and administrators to collect and analyze data from Java applications running locally or deployed in production environments.
Security Fix(es):
* lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566)
* org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in lz4-java. This vulnerability allows disclosure of sensitive data via crafted compressed input due to insufficient clearing of the output buffer in Java-based decompressor implementations.
7.5 (High)
Affected products
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Threats
Impact
Important
References
17 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for jmc is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis of the extensive data collected by JDK Flight Recorder. The tool chain enables developers and administrators to collect and analyze data from Java applications running locally or deployed in production environments.\n\nSecurity Fix(es):\n\n* lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566)\n\n* org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:20568",
"url": "https://access.redhat.com/errata/RHSA-2026:20568"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2419500",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419500"
},
{
"category": "external",
"summary": "2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20568.json"
}
],
"title": "Red Hat Security Advisory: jmc security update",
"tracking": {
"current_release_date": "2026-09-09T22:58:15+00:00",
"generator": {
"date": "2026-09-09T22:58:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:20568",
"initial_release_date": "2026-05-26T01:50:24+00:00",
"revision_history": [
{
"date": "2026-05-26T01:50:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-26T01:50:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T22:58:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "jmc-0:8.2.0-19.el9_8.2.src",
"product": {
"name": "jmc-0:8.2.0-19.el9_8.2.src",
"product_id": "jmc-0:8.2.0-19.el9_8.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jmc@8.2.0-19.el9_8.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jmc-0:8.2.0-19.el9_8.2.x86_64",
"product": {
"name": "jmc-0:8.2.0-19.el9_8.2.x86_64",
"product_id": "jmc-0:8.2.0-19.el9_8.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jmc@8.2.0-19.el9_8.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jmc-0:8.2.0-19.el9_8.2.src as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src"
},
"product_reference": "jmc-0:8.2.0-19.el9_8.2.src",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jmc-0:8.2.0-19.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
},
"product_reference": "jmc-0:8.2.0-19.el9_8.2.x86_64",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-66566",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2025-12-05T19:00:50.134024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2419500"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lz4-java. This vulnerability allows disclosure of sensitive data via crafted compressed input due to insufficient clearing of the output buffer in Java-based decompressor implementations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated IMPORTANT because it allows for information disclosure when Java-based decompressor implementations reuse output buffers without proper clearing, potentially exposing sensitive data via crafted compressed input. JNI-based implementations of lz4-java are not affected by this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src",
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66566"
},
{
"category": "external",
"summary": "RHBZ#2419500",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419500"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66566",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66566"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66566",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66566"
},
{
"category": "external",
"summary": "https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840",
"url": "https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840"
},
{
"category": "external",
"summary": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q",
"url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q"
}
],
"release_date": "2025-12-05T18:10:16.470000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-26T01:50:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src",
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:20568"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src",
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src",
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-26T01:50:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src",
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:20568"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src",
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.src",
"CRB-9.8.0.Z.MAIN.EUS:jmc-0:8.2.0-19.el9_8.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
}
]
}
RHSA-2026:21773
Vulnerability from csaf_redhat - Published: 2026-05-28 22:46 - Updated: 2026-09-10 11:15Summary
Red Hat Security Advisory: Red Hat Offline Knowledge Portal security and content update
Severity
Important
Notes
Topic: Red Hat Offline Knowledge Portal security fixes, bug fixes, enhancements & content update
Details: This Red Hat Offline Knowledge Portal release upgrades from Solr 9.8.1 to Solr 10.0.0, and fixes several CVEs. It also includes content updates as of May 26 2026.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in org.eclipse.jetty. The Jetty URI parser handles invalid or unusual Uniform Resource Identifiers (URIs) differently compared to other common parsers. This discrepancy, known as differential parsing, can lead to security bypasses in systems that use multiple components to process URIs, such as when a blacklist enforcement component interprets a URI differently from a response generation component. At a minimum, this issue could unintentionally reveal internal system details.
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Log4j Core. A network-based attacker can perform a man-in-the-middle (MITM) attack, allowing them to intercept encrypted communications. This occurs when an SMTP, Socket, or Syslog appender uses Transport Layer Security (TLS) with a nested <Ssl> element, and the attacker has a certificate from a trusted Certificate Authority (CA). The vulnerability stems from an incomplete hostname verification fix, making TLS connections susceptible to interception.
6.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed (CRLF) sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-based syslog services. An attacker could exploit this to inject malicious data into log files, potentially obscuring critical security events or manipulating system records.
5.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Apache Log4j 1-to-Log4j 2 bridge. The Log4j1XmlLayout component fails to properly escape characters forbidden by the XML 1.0 standard. This improper handling of characters results in malformed XML output, which can cause downstream log processing systems to drop or fail to index affected records. The primary consequence is a denial of service for log analysis, potentially hindering security monitoring and incident response.
5.3 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.
5.3 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This invalid output can then lead to downstream systems rejecting or failing to index these logs, effectively causing a denial of service for log analysis.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
64 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Offline Knowledge Portal security fixes, bug fixes, enhancements \u0026 content update",
"title": "Topic"
},
{
"category": "general",
"text": "This Red Hat Offline Knowledge Portal release upgrades from Solr 9.8.1 to Solr 10.0.0, and fixes several CVEs. It also includes content updates as of May 26 2026.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:21773",
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/red-hat-offline-knowledge-portal",
"url": "https://access.redhat.com/products/red-hat-offline-knowledge-portal"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-11143",
"url": "https://access.redhat.com/security/cve/CVE-2025-11143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34477",
"url": "https://access.redhat.com/security/cve/CVE-2026-34477"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34478",
"url": "https://access.redhat.com/security/cve/CVE-2026-34478"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34479",
"url": "https://access.redhat.com/security/cve/CVE-2026-34479"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34480",
"url": "https://access.redhat.com/security/cve/CVE-2026-34480"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34481",
"url": "https://access.redhat.com/security/cve/CVE-2026-34481"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_offline_knowledge_portal/1",
"url": "https://docs.redhat.com/en/documentation/red_hat_offline_knowledge_portal/1"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21773.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Offline Knowledge Portal security and content update",
"tracking": {
"current_release_date": "2026-09-10T11:15:28+00:00",
"generator": {
"date": "2026-09-10T11:15:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:21773",
"initial_release_date": "2026-05-28T22:46:23+00:00",
"revision_history": [
{
"date": "2026-05-28T22:46:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T11:15:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Offline Knowledge Portal 1.2.12",
"product": {
"name": "Red Hat Offline Knowledge Portal 1.2.12",
"product_id": "Red Hat Offline Knowledge Portal 1.2.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:offline_knowledge_portal:1.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Offline Knowledge Portal"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64",
"product": {
"name": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64",
"product_id": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhokp-rhel9@sha256%3Aec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36?arch=amd64\u0026repository_url=registry.redhat.io/offline-knowledge-portal/rhokp-rhel9\u0026tag=1779996999"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"product": {
"name": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"product_id": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/rhokp-rhel9@sha256%3Ab26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e?arch=arm64\u0026repository_url=registry.redhat.io/offline-knowledge-portal/rhokp-rhel9\u0026tag=1779996999"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64 as a component of Red Hat Offline Knowledge Portal 1.2.12",
"product_id": "Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64"
},
"product_reference": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"relates_to_product_reference": "Red Hat Offline Knowledge Portal 1.2.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64 as a component of Red Hat Offline Knowledge Portal 1.2.12",
"product_id": "Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
},
"product_reference": "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64",
"relates_to_product_reference": "Red Hat Offline Knowledge Portal 1.2.12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11143",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-03-05T10:00:56.604564+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444808"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. The Jetty URI parser handles invalid or unusual Uniform Resource Identifiers (URIs) differently compared to other common parsers. This discrepancy, known as differential parsing, can lead to security bypasses in systems that use multiple components to process URIs, such as when a blacklist enforcement component interprets a URI differently from a response generation component. At a minimum, this issue could unintentionally reveal internal system details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low by Red Hat. Successful usage of this vulnerability is non-trivial, as the attacker must be able to craft a URI that exploits Jetty\u0027s differential parsing while bypassing other parsers (ex. in a firewall or load balancer). Additionally, divulging implementation details is possible but not guaranteed while also being indirect, meaning that an attacker may be able to obtain error messages or behavioral differences, but those are not guaranteed. As such, there is likely no direct leak of sensitive data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-11143"
},
{
"category": "external",
"summary": "RHBZ#2444808",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444808"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-11143",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh"
}
],
"release_date": "2026-03-05T09:26:59.830000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-28T22:46:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-28T22:46:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-34477",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-04-10T16:01:36.691709+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457319"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Log4j Core. A network-based attacker can perform a man-in-the-middle (MITM) attack, allowing them to intercept encrypted communications. This occurs when an SMTP, Socket, or Syslog appender uses Transport Layer Security (TLS) with a nested \u003cSsl\u003e element, and the attacker has a certificate from a trusted Certificate Authority (CA). The vulnerability stems from an incomplete hostname verification fix, making TLS connections susceptible to interception.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34477"
},
{
"category": "external",
"summary": "RHBZ#2457319",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457319"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34477"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34477",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34477"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4075",
"url": "https://github.com/apache/logging-log4j2/pull/4075"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4",
"url": "https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName",
"url": "https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34477",
"url": "https://logging.apache.org/security.html#CVE-2026-34477"
}
],
"release_date": "2026-04-10T15:36:19.740000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-28T22:46:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification"
},
{
"cve": "CVE-2026-34478",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-04-10T16:01:52.683616+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457323"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed (CRLF) sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-based syslog services. An attacker could exploit this to inject malicious data into log files, potentially obscuring critical security events or manipulating system records.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability allows log injection via CRLF sequences due to silently renamed security attributes in Rfc5424Layout. This affects Red Hat products that directly configure Rfc5424Layout with stream-based syslog services, potentially enabling an attacker to obscure or manipulate log records. This impact is limited to specific configurations, as users of the SyslogAppender are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34478"
},
{
"category": "external",
"summary": "RHBZ#2457323",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457323"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34478"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34478",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34478"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4074",
"url": "https://github.com/apache/logging-log4j2/pull/4074"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt",
"url": "https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout",
"url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34478",
"url": "https://logging.apache.org/security.html#CVE-2026-34478"
}
],
"release_date": "2026-04-10T15:40:17.713000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-28T22:46:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames"
},
{
"cve": "CVE-2026-34479",
"cwe": {
"id": "CWE-91",
"name": "XML Injection (aka Blind XPath Injection)"
},
"discovery_date": "2026-04-10T16:01:11.900823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457313"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Log4j 1-to-Log4j 2 bridge. The Log4j1XmlLayout component fails to properly escape characters forbidden by the XML 1.0 standard. This improper handling of characters results in malformed XML output, which can cause downstream log processing systems to drop or fail to index affected records. The primary consequence is a denial of service for log analysis, potentially hindering security monitoring and incident response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34479"
},
{
"category": "external",
"summary": "RHBZ#2457313",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457313"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34479"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34479",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34479"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4078",
"url": "https://github.com/apache/logging-log4j2/pull/4078"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on",
"url": "https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html",
"url": "https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34479",
"url": "https://logging.apache.org/security.html#CVE-2026-34479"
}
],
"release_date": "2026-04-10T15:41:07.888000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-28T22:46:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping"
},
{
"cve": "CVE-2026-34480",
"cwe": {
"id": "CWE-168",
"name": "Improper Handling of Inconsistent Special Elements"
},
"discovery_date": "2026-04-10T16:02:17.024798+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457328"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in Apache Log4j Core\u0027s XmlLayout component can lead to a denial of service in logging operations when log messages contain characters forbidden by the XML 1.0 specification. Systems processing these logs may fail to read records or the logging process may cease event delivery, impacting monitoring and auditing capabilities in affected Red Hat products. Red Hat products in their default configurations will be able to automatically recover, but some log messages may be lost.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34480"
},
{
"category": "external",
"summary": "RHBZ#2457328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457328"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4077",
"url": "https://github.com/apache/logging-log4j2/pull/4077"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb",
"url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout",
"url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34480",
"url": "https://logging.apache.org/security.html#CVE-2026-34480"
}
],
"release_date": "2026-04-10T15:42:03.843000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-28T22:46:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging"
},
{
"cve": "CVE-2026-34481",
"cwe": {
"id": "CWE-241",
"name": "Improper Handling of Unexpected Data Type"
},
"discovery_date": "2026-04-10T16:01:44.581898+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Log4j\u0027s JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This invalid output can then lead to downstream systems rejecting or failing to index these logs, effectively causing a denial of service for log analysis.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this flaw requires an application to be configured with JsonTemplateLayout and to log attacker-controlled non-finite floating-point values within a MapMessage, which is not a default or common configuration in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34481"
},
{
"category": "external",
"summary": "RHBZ#2457321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34481"
},
{
"category": "external",
"summary": "https://github.com/apache/logging-log4j2/pull/4080",
"url": "https://github.com/apache/logging-log4j2/pull/4080"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv",
"url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv"
},
{
"category": "external",
"summary": "https://logging.apache.org/cyclonedx/vdr.xml",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"category": "external",
"summary": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html",
"url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html"
},
{
"category": "external",
"summary": "https://logging.apache.org/security.html#CVE-2026-34481",
"url": "https://logging.apache.org/security.html#CVE-2026-34481"
}
],
"release_date": "2026-04-10T15:43:00.100000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-28T22:46:23+00:00",
"details": "The container image provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:21773"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:b26253f0a6c6b9e8c8458ecb07e79e9f87ff313491fffc31e342e32bce0a2b3e_arm64",
"Red Hat Offline Knowledge Portal 1.2.12:registry.redhat.io/offline-knowledge-portal/rhokp-rhel9@sha256:ec8b14b7a170b689a19cee7820888e81ddc3affc2faada6cc6139644f328bd36_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output"
}
]
}
RHSA-2026:22453
Vulnerability from csaf_redhat - Published: 2026-06-02 11:27 - Updated: 2026-09-09 22:58Summary
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA)
Severity
Important
Notes
Topic: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.
Red Hat Product Security has rated this update as having a security impact of Important.
Details: An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA).
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:
* camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data [rhboac-camel-quarkus-3] (CVE-2026-40858)
* camel-infinispan-common: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data [rhboac-camel-quarkus-3] (CVE-2026-40858)
* camel-amqp: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage [rhboac-camel-quarkus-3] (CVE-2026-40860)
* camel-jms: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage [rhboac-camel-quarkus-3] (CVE-2026-40860)
* camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization [rhboac-camel-quarkus-3] (CVE-2026-6857)
* jetty-http: HTTP request smuggling via chunked extension quoted-string parsing [rhboac-camel-quarkus-3] (CVE-2026-2332)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the camel-infinispan component of Apache Camel. A remote attacker, with the ability to write to the Infinispan cache, can inject a specially crafted serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitrary code execution within the application. This vulnerability stems from the component's use of java.io.ObjectInputStream without proper input filtering.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service (JMS) ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message payload without proper validation. Successful exploitation could lead to remote code execution on the system consuming the message, provided a deserialization gadget chain is present on the classpath.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_quarkus:3.33
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
References
32 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\nRed Hat Product Security has rated this update as having a security impact of Important.",
"title": "Topic"
},
{
"category": "general",
"text": "An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data [rhboac-camel-quarkus-3] (CVE-2026-40858)\n* camel-infinispan-common: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data [rhboac-camel-quarkus-3] (CVE-2026-40858)\n* camel-amqp: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage [rhboac-camel-quarkus-3] (CVE-2026-40860)\n* camel-jms: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage [rhboac-camel-quarkus-3] (CVE-2026-40860)\n* camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization [rhboac-camel-quarkus-3] (CVE-2026-6857)\n* jetty-http: HTTP request smuggling via chunked extension quoted-string parsing [rhboac-camel-quarkus-3] (CVE-2026-2332)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22453",
"url": "https://access.redhat.com/errata/RHSA-2026:22453"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40858",
"url": "https://access.redhat.com/security/cve/CVE-2026-40858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40860",
"url": "https://access.redhat.com/security/cve/CVE-2026-40860"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6857",
"url": "https://access.redhat.com/security/cve/CVE-2026-6857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "2460003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460003"
},
{
"category": "external",
"summary": "2463172",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463172"
},
{
"category": "external",
"summary": "2463179",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463179"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22453.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.1.GA)",
"tracking": {
"current_release_date": "2026-09-09T22:58:16+00:00",
"generator": {
"date": "2026-09-09T22:58:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:22453",
"initial_release_date": "2026-06-02T11:27:09+00:00",
"revision_history": [
{
"date": "2026-06-02T11:27:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-02T11:27:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T22:58:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"product": {
"name": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"product_id": "Red Hat Build of Apache Camel 4.18 for Quarkus 3.33",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_quarkus:3.33"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:27:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22453"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"acknowledgments": [
{
"names": [
"Feng Ning"
],
"organization": "Innora Pte. Ltd."
}
],
"cve": "CVE-2026-6857",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460003"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has an Important impact on Red Hat products utilizing `camel-infinispan` for remote aggregation. The flaw stems from unsafe deserialization within the ProtoStream remote aggregation repository, which could lead to remote code execution. This affects Red Hat Enterprise Application Platform and Red Hat JBoss Fuse when configured to use `camel-infinispan`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6857"
},
{
"category": "external",
"summary": "RHBZ#2460003",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6857"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6857",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6857"
}
],
"release_date": "2026-04-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:27:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22453"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization"
},
{
"cve": "CVE-2026-40858",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:35.538625+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463179"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the camel-infinispan component of Apache Camel. A remote attacker, with the ability to write to the Infinispan cache, can inject a specially crafted serialized Java object. When this object is deserialized during normal aggregation repository operations, it can lead to arbitrary code execution within the application. This vulnerability stems from the component\u0027s use of java.io.ObjectInputStream without proper input filtering.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40858"
},
{
"category": "external",
"summary": "RHBZ#2463179",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463179"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40858"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40858",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40858"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-40858.html",
"url": "https://camel.apache.org/security/CVE-2026-40858.html"
}
],
"release_date": "2026-04-27T09:38:55.466000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:27:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22453"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.camel/camel-infinispan: Apache Camel camel-infinispan: Arbitrary code execution via deserialization of untrusted data"
},
{
"cve": "CVE-2026-40860",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:11.044535+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463172"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Camel. A remote attacker could exploit a deserialization vulnerability by sending a specially crafted Java Message Service (JMS) ObjectMessage to a Camel application acting as a JMS consumer. This vulnerability arises because the application deserializes the message payload without proper validation. Successful exploitation could lead to remote code execution on the system consuming the message, provided a deserialization gadget chain is present on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40860"
},
{
"category": "external",
"summary": "RHBZ#2463172",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463172"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40860"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/26/10",
"url": "http://www.openwall.com/lists/oss-security/2026/04/26/10"
},
{
"category": "external",
"summary": "https://camel.apache.org/security/CVE-2026-40860.html",
"url": "https://camel.apache.org/security/CVE-2026-40860.html"
}
],
"release_date": "2026-04-27T08:03:19.616000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:27:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22453"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Apache Camel 4.18 for Quarkus 3.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Camel: camel-jms: camel-sjms: camel-sjms2: camel-amqp: camel-activemq: camel-activemq6: Apache Camel: Remote Code Execution via deserialization of JMS ObjectMessage"
}
]
}
RHSA-2026:25089
Vulnerability from csaf_redhat - Published: 2026-06-10 15:39 - Updated: 2026-09-10 10:16Summary
Red Hat Security Advisory: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
Severity
Important
Notes
Topic: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 GA Release is now available.
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 GA Release is now available.
The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.
* spring boot: Remote code execution via timing attack in DevTools remote secret comparison [CVE-2026-40972]
* axios: Invisible JSON Response Tampering via Prototype Pollution Gadget [CVE-2026-42044]
* spring-boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory [CVE-2026-40973]
* io.hawt-project: fast-uri: Path traversal vulnerability allows bypass of security policies [CVE-2026-6321]
* axios: Authentication bypass due to prototype pollution of HTTP error handling [CVE-2026-42041]
* axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data [CVE-2026-42039]
* axios: NO_PROXY bypass via crafted URL [CVE-2026-42043]
* axios: HTTP Transport Hijacking via Prototype Pollution [CVE-2026-42033]
* spring-boot: Weak pseudo-random number generation can lead to information disclosure. [CVE-2026-40975]
* io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests [CVE-2026-39852]
* jetty-ee10-webapp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables [CVE-2026-5795]
* jetty-ee10-servlet: early return from the JASPIAuthenticator class without clearing ThreadLocal variables [CVE-2026-5795]
* spring-boot: Authentication bypass via misconfigured Health Group additional path [CVE-2026-22731]
* jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests [CVE-2026-1605]
* vertx-core: static handler component cache can be manipulated to deny the access to static files [CVE-2026-1002]
* io.hawt-project: prototype pollution in _.unset and _.omit functions [CVE-2025-13465]
* hawtio-operator-container: golang: Denial of Service due to excessive resource consumption via crafted certificate [CVE-2025-61729]
* hawtio-operator-container: Memory exhaustion in query parameter parsing in net/url [CVE-2025-61726]
* axios:Arbitrary HTTP header injection via prototype pollution [CVE-2026-42035]
* jetty-http: HTTP request smuggling via chunked extension quoted-string parsing [CVE-2026-2332]
* hawtio-operator-container: Go: Denial of Service vulnerability in certificate chain building [CVE-2026-32280]
* hawtio-operator-container: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application [CVE-2026-33810]
* hawtio-operator-container: Go crypto/x509: Denial of Service via inefficient certificate chain validation [CVE-2026-32281]
* hawtio-operator-container: Root.Chmod can follow symlinks out of the root [CVE-2026-32282]
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The `JASPIAuthenticator` class is responsible for handling authentication checks. During these checks, the class sets two ThreadLocal variables to store authentication state. Under certain conditions, the authentication process can return early without properly clearing the ThreadLocal variables, allowing a subsequent request to inherit the un-cleared ThreadLocal values. This issue can cause broken access control, authentication bypass, privilege escalation and data breaches.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected endpoints. The vulnerability arises because Quarkus's security layer performs authorization checks on the raw URL path, which preserves these matrix parameters.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to remote code execution in the remote application.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Spring Boot. A local attacker on the same host as the application may be able to take control of the `ApplicationTemp` directory due to predictable temporary directory handling. When the `server.servlet.session.persistent` setting is enabled and the attack persists across application restarts, this could allow the attacker to read session information, hijack authenticated user sessions, or execute arbitrary code as the application's user.
7.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Spring Boot. The `${random.value}` property source utilizes a weak pseudo-random number generator (PRNG), meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information disclosure or a security bypass if they are used in sensitive applications.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application's core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution "Gadget" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
HawtIO HawtIO 4.4.0
Red Hat / Red Hat Build of Apache Camel
|
cpe:/a:redhat:apache_camel_hawtio:4.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
135 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "HawtIO 4.4.0 for Red Hat build of Apache Camel 4 GA Release is now available.\n\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\n\nRed Hat Product Security has rated this update as having a security impact of\nImportant. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "HawtIO 4.4.0 for Red Hat build of Apache Camel 4 GA Release is now available.\n\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\n\n* spring boot: Remote code execution via timing attack in DevTools remote secret comparison [CVE-2026-40972]\n\n* axios: Invisible JSON Response Tampering via Prototype Pollution Gadget [CVE-2026-42044]\n\n* spring-boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory [CVE-2026-40973]\n\n* io.hawt-project: fast-uri: Path traversal vulnerability allows bypass of security policies [CVE-2026-6321]\n\n* axios: Authentication bypass due to prototype pollution of HTTP error handling [CVE-2026-42041]\n\n* axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data [CVE-2026-42039]\n\n* axios: NO_PROXY bypass via crafted URL [CVE-2026-42043]\n\n* axios: HTTP Transport Hijacking via Prototype Pollution [CVE-2026-42033]\n\n* spring-boot: Weak pseudo-random number generation can lead to information disclosure. [CVE-2026-40975]\n\n* io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests [CVE-2026-39852]\n\n* jetty-ee10-webapp: early return from the JASPIAuthenticator class without clearing ThreadLocal variables [CVE-2026-5795]\n\n* jetty-ee10-servlet: early return from the JASPIAuthenticator class without clearing ThreadLocal variables [CVE-2026-5795]\n\n* spring-boot: Authentication bypass via misconfigured Health Group additional path [CVE-2026-22731]\n\n* jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests [CVE-2026-1605]\n\n* vertx-core: static handler component cache can be manipulated to deny the access to static files [CVE-2026-1002]\n\n* io.hawt-project: prototype pollution in _.unset and _.omit functions [CVE-2025-13465]\n\n* hawtio-operator-container: golang: Denial of Service due to excessive resource consumption via crafted certificate [CVE-2025-61729]\n\n* hawtio-operator-container: Memory exhaustion in query parameter parsing in net/url [CVE-2025-61726]\n\n* axios:Arbitrary HTTP header injection via prototype pollution [CVE-2026-42035]\n\n* jetty-http: HTTP request smuggling via chunked extension quoted-string parsing [CVE-2026-2332]\n\n* hawtio-operator-container: Go: Denial of Service vulnerability in certificate chain building [CVE-2026-32280]\n\n* hawtio-operator-container: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application [CVE-2026-33810]\n\n* hawtio-operator-container: Go crypto/x509: Denial of Service via inefficient certificate chain validation [CVE-2026-32281]\n\n* hawtio-operator-container: Root.Chmod can follow symlinks out of the root [CVE-2026-32282]",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:25089",
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25089.json"
}
],
"title": "Red Hat Security Advisory: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.",
"tracking": {
"current_release_date": "2026-09-10T10:16:09+00:00",
"generator": {
"date": "2026-09-10T10:16:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:25089",
"initial_release_date": "2026-06-10T15:39:02+00:00",
"revision_history": [
{
"date": "2026-06-10T15:39:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-10T15:39:02+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T10:16:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "HawtIO HawtIO 4.4.0",
"product": {
"name": "HawtIO HawtIO 4.4.0",
"product_id": "HawtIO HawtIO 4.4.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:apache_camel_hawtio:4.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Build of Apache Camel"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-13465",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"discovery_date": "2026-01-21T20:01:28.774829+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431740"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: prototype pollution in _.unset and _.omit functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.\n\nIn Grafana, JavaScript code runs only in the browser, while the server side is all Golang. Therefore, the worst-case scenario is a loss of functionality in the client application inside the browser. To reflect this, the CVSS availability metric and the severity of the Grafana and the Grafana-PCP component have been updated to low and moderate, respectively.\n\nThe lodash dependency is bundled and used by the pcs-web-ui component of the PCS package. In Red Hat Enterprise Linux 8.10, the pcs-web-ui component is no longer included in the PCS package. As a result, RHEL 8.10 does not ship the vulnerable lodash component within PCS and is therefore not-affected by this CVE.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13465"
},
{
"category": "external",
"summary": "RHBZ#2431740",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
}
],
"release_date": "2026-01-21T19:05:28.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: prototype pollution in _.unset and _.omit functions"
},
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61729",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2025-12-02T20:01:45.330964+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418462"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61729"
},
{
"category": "external",
"summary": "RHBZ#2418462",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
},
{
"category": "external",
"summary": "https://go.dev/cl/725920",
"url": "https://go.dev/cl/725920"
},
{
"category": "external",
"summary": "https://go.dev/issue/76445",
"url": "https://go.dev/issue/76445"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4155",
"url": "https://pkg.go.dev/vuln/GO-2025-4155"
}
],
"release_date": "2025-12-02T18:54:10.166000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
},
{
"cve": "CVE-2026-1002",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-01-15T21:03:20.088599+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2430180"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability allows a remote attacker to block access to specific static files, such as images, CSS or HTML files. However, the underlying Vert.x server, the API endpoints and other non-cached resources are not affected. Due to this reason, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1002"
},
{
"category": "external",
"summary": "RHBZ#2430180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430180"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1002"
},
{
"category": "external",
"summary": "https://github.com/eclipse-vertx/vert.x/pull/5895",
"url": "https://github.com/eclipse-vertx/vert.x/pull/5895"
}
],
"release_date": "2026-01-15T20:50:25.642000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example:\n\n~~~\nStaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);\n~~~",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-5795",
"cwe": {
"id": "CWE-226",
"name": "Sensitive Information in Resource Not Removed Before Reuse"
},
"discovery_date": "2026-04-08T14:01:02.911884+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456519"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The `JASPIAuthenticator` class is responsible for handling authentication checks. During these checks, the class sets two ThreadLocal variables to store authentication state. Under certain conditions, the authentication process can return early without properly clearing the ThreadLocal variables, allowing a subsequent request to inherit the un-cleared ThreadLocal values. This issue can cause broken access control, authentication bypass, privilege escalation and data breaches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is only exploitable when `JASPIAuthenticator` class returns early and a subsequent request inherits the un-cleared ThreadLocal values. This requires a new request to be assigned the exact same recycled thread, increasing the complexity of exploitation. Due to these reasons, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5795"
},
{
"category": "external",
"summary": "RHBZ#2456519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456519"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5795"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-gc59-r5jq-98qw",
"url": "https://github.com/advisories/GHSA-gc59-r5jq-98qw"
}
],
"release_date": "2026-04-08T13:32:28.935000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables"
},
{
"cve": "CVE-2026-6321",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-04T20:01:14.938426+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466582"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6321"
},
{
"category": "external",
"summary": "RHBZ#2466582",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466582"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6321"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6321",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6321"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6"
}
],
"release_date": "2026-05-04T19:31:57.253000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies"
},
{
"cve": "CVE-2026-22731",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-03-19T23:02:37.111109+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449290"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22731"
},
{
"category": "external",
"summary": "RHBZ#2449290",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449290"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22731",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22731"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22731"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-22731",
"url": "https://spring.io/security/cve-2026-22731"
}
],
"release_date": "2026-03-19T22:36:15.112000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "To mitigate, ensure that application endpoints requiring authentication are not declared under paths already configured as Health Group additional paths within Spring Boot applications using Actuator. Review and adjust your application\u0027s configuration to prevent this overlap. A redeployment of the application is required for changes to take effect.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-39852",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-04-13T13:26:46.572000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected endpoints. The vulnerability arises because Quarkus\u0027s security layer performs authorization checks on the raw URL path, which preserves these matrix parameters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39852"
},
{
"category": "external",
"summary": "RHBZ#2457819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39852"
},
{
"category": "external",
"summary": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9",
"url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9"
}
],
"release_date": "2026-05-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure a reverse proxy or load balancer in front of the Quarkus application to normalize incoming URL paths by stripping matrix parameters (semicolons) before requests reach the Quarkus security layer. This ensures that authorization checks are performed on the intended path. Ensure that any changes to proxy configurations are thoroughly tested and services are reloaded or restarted as necessary to apply the new settings.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests"
},
{
"cve": "CVE-2026-40972",
"cwe": {
"id": "CWE-208",
"name": "Observable Timing Discrepancy"
},
"discovery_date": "2026-04-28T00:02:02.075124+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to remote code execution in the remote application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40972"
},
{
"category": "external",
"summary": "RHBZ#2463332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40972"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40972",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40972"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40972",
"url": "https://spring.io/security/cve-2026-40972"
}
],
"release_date": "2026-04-27T23:15:19.194000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the Spring Boot DevTools remote functionality in production environments. This feature is primarily intended for development and should not be enabled in publicly accessible deployments.\n\nTo disable remote DevTools, ensure the `spring.devtools.remote.secret` property is not configured, or explicitly set `spring.devtools.remote.enabled=false` in your application\u0027s `application.properties` or `application.yml` file.\n\nExample for `application.properties`:\n`spring.devtools.remote.enabled=false`\n\nDisabling this feature may impact development workflows that rely on remote DevTools capabilities. A restart of the application is required for the changes to take effect.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison"
},
{
"cve": "CVE-2026-40973",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-04-28T00:01:55.408040+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. A local attacker on the same host as the application may be able to take control of the `ApplicationTemp` directory due to predictable temporary directory handling. When the `server.servlet.session.persistent` setting is enabled and the attack persists across application restarts, this could allow the attacker to read session information, hijack authenticated user sessions, or execute arbitrary code as the application\u0027s user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40973"
},
{
"category": "external",
"summary": "RHBZ#2463330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40973",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40973"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40973",
"url": "https://spring.io/security/cve-2026-40973"
}
],
"release_date": "2026-04-27T23:29:51.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the `server.servlet.session.persistent` property is set to `false` in your Spring Boot application\u0027s configuration. This prevents session information from being written to the predictable temporary directory, thereby removing the conditions necessary for exploitation. Disabling persistent sessions may affect application behavior that relies on session data surviving restarts.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory"
},
{
"cve": "CVE-2026-40975",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-04-28T00:01:58.716976+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Spring Boot. The `${random.value}` property source utilizes a weak pseudo-random number generator (PRNG), meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information disclosure or a security bypass if they are used in sensitive applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40975"
},
{
"category": "external",
"summary": "RHBZ#2463331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40975"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40975",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40975"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-40975",
"url": "https://spring.io/security/cve-2026-40975"
}
],
"release_date": "2026-04-27T23:32:58.596000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Applications utilizing Spring Boot should avoid using the `${random.value}` property for generating cryptographic secrets or other security-sensitive data. Developers should review their application configurations and code to ensure that only cryptographically strong random number generators are used for such purposes. For UUID generation, `${random.uuid}` is not affected and can be used.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure."
},
{
"cve": "CVE-2026-42033",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:20.937507+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461607"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42033"
},
{
"category": "external",
"summary": "RHBZ#2461607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
}
],
"release_date": "2026-04-24T17:36:44.132000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution"
},
{
"cve": "CVE-2026-42035",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T18:01:17.109481+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461606"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application\u0027s core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42035"
},
{
"category": "external",
"summary": "RHBZ#2461606",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461606"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
}
],
"release_date": "2026-04-24T17:38:07.752000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution"
},
{
"cve": "CVE-2026-42039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T19:01:44.887156+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42039"
},
{
"category": "external",
"summary": "RHBZ#2461630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
}
],
"release_date": "2026-04-24T18:01:30.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
},
{
"cve": "CVE-2026-42041",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:41.034289+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461629"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42041"
},
{
"category": "external",
"summary": "RHBZ#2461629",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461629"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
"url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
}
],
"release_date": "2026-04-24T17:55:30.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling"
},
{
"cve": "CVE-2026-42043",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-04-24T19:01:22.552379+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: NO_PROXY bypass via crafted URL",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42043"
},
{
"category": "external",
"summary": "RHBZ#2461626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
}
],
"release_date": "2026-04-24T17:54:42.668000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: NO_PROXY bypass via crafted URL"
},
{
"cve": "CVE-2026-42044",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-04-24T19:01:13.418725+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461624"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as a Prototype Pollution \"Gadget\" attack, allows a remote attacker to subtly alter JSON API responses. By manipulating a specific function, an attacker can selectively modify data within these responses. This could lead to significant security breaches, including unauthorized privilege escalation, fraudulent balance manipulation, or bypassing critical authorization checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"HawtIO HawtIO 4.4.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42044"
},
{
"category": "external",
"summary": "RHBZ#2461624",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461624"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42044"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"
}
],
"release_date": "2026-04-24T17:49:49.517000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T15:39:02+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"HawtIO HawtIO 4.4.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"HawtIO HawtIO 4.4.0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"HawtIO HawtIO 4.4.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget"
}
]
}
RHSA-2026:50221
Vulnerability from csaf_redhat - Published: 2026-08-04 16:01 - Updated: 2026-09-09 22:31Summary
Red Hat Security Advisory: Satellite 6.19.3 Async Update
Severity
Important
Notes
Topic: A new release is now available for Red Hat Satellite 6.19 for RHEL 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515)
* openvox-server: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)
* rubygem-faraday: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday_middleware: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-em_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-em_synchrony: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-excon: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-httpclient: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-multipart: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-net_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-net_http_persistent: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-patron: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-faraday-retry: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)
* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)
* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
69 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.
4.3 (Medium)
Affected products
Fixed
2 products
Known not affected
71 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
Known not affected
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application's processing thread or worker.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
69 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document's current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.
6.5 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
References
55 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new release is now available for Red Hat Satellite 6.19 for RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515)\n* openvox-server: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)\n* rubygem-faraday: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday_middleware: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-em_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-em_synchrony: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-excon: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-httpclient: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-multipart: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-net_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-net_http_persistent: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-patron: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-faraday-retry: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)\n* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)\n* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)\n* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)\n* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50221",
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "SAT-42697",
"url": "https://issues.redhat.com/browse/SAT-42697"
},
{
"category": "external",
"summary": "SAT-47597",
"url": "https://issues.redhat.com/browse/SAT-47597"
},
{
"category": "external",
"summary": "SAT-47598",
"url": "https://issues.redhat.com/browse/SAT-47598"
},
{
"category": "external",
"summary": "SAT-47599",
"url": "https://issues.redhat.com/browse/SAT-47599"
},
{
"category": "external",
"summary": "SAT-47601",
"url": "https://issues.redhat.com/browse/SAT-47601"
},
{
"category": "external",
"summary": "SAT-47602",
"url": "https://issues.redhat.com/browse/SAT-47602"
},
{
"category": "external",
"summary": "SAT-47604",
"url": "https://issues.redhat.com/browse/SAT-47604"
},
{
"category": "external",
"summary": "SAT-47605",
"url": "https://issues.redhat.com/browse/SAT-47605"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50221.json"
}
],
"title": "Red Hat Security Advisory: Satellite 6.19.3 Async Update",
"tracking": {
"current_release_date": "2026-09-09T22:31:33+00:00",
"generator": {
"date": "2026-09-09T22:31:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:50221",
"initial_release_date": "2026-08-04T16:01:00+00:00",
"revision_history": [
{
"date": "2026-08-04T16:01:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-04T16:01:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T22:31:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.19 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.19::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.19 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.19::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.19 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.19::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite 6"
},
{
"branches": [
{
"category": "product_version",
"name": "foreman-0:3.18.0.8-1.el9sat.src",
"product": {
"name": "foreman-0:3.18.0.8-1.el9sat.src",
"product_id": "foreman-0:3.18.0.8-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman@3.18.0.8-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.18.0.2-1.el9sat.src",
"product": {
"name": "foreman-installer-1:3.18.0.2-1.el9sat.src",
"product_id": "foreman-installer-1:3.18.0.2-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.18.0.2-1.el9sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product_id": "openvox-server-0:8.14.1-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"product": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"product_id": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow@12.3.0-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"product": {
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"product_id": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pulp-rpm@3.32.10-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"product": {
"name": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"product_id": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_openscap@12.1.2-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"product": {
"name": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"product_id": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_rh_cloud@13.2.10-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.20.0.7-1.el9sat.src",
"product": {
"name": "rubygem-katello-0:4.20.0.7-1.el9sat.src",
"product_id": "rubygem-katello-0:4.20.0.7-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.20.0.7-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"product": {
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"product_id": "rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.17.2-3.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.19.3-1.el9sat.src",
"product": {
"name": "satellite-0:6.19.3-1.el9sat.src",
"product_id": "satellite-0:6.19.3-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.19.3-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-debug@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-pcp@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-cli@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-dynflow-sidekiq@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-ec2@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-journald@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-libvirt@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-openstack@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-postgresql@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-redis@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-service-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-service-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-service-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-service@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-telemetry@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"product": {
"name": "foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"product_id": "foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-vmware@3.18.0.8-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"product": {
"name": "foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"product_id": "foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.18.0.2-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"product": {
"name": "foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"product_id": "foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer-katello@3.18.0.2-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_id": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"product": {
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"product_id": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pulp-rpm@3.32.10-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"product": {
"name": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"product_id": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_openscap@12.1.2-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"product": {
"name": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"product_id": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_rh_cloud@13.2.10-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"product": {
"name": "rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"product_id": "rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.20.0.7-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.19.3-1.el9sat.noarch",
"product": {
"name": "satellite-capsule-0:6.19.3-1.el9sat.noarch",
"product_id": "satellite-capsule-0:6.19.3-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.19.3-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.19.3-1.el9sat.noarch",
"product": {
"name": "satellite-common-0:6.19.3-1.el9sat.noarch",
"product_id": "satellite-common-0:6.19.3-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.19.3-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"product": {
"name": "satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"product_id": "satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-obsolete-packages@6.19.3-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.19.3-1.el9sat.noarch",
"product": {
"name": "satellite-0:6.19.3-1.el9sat.noarch",
"product_id": "satellite-0:6.19.3-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.19.3-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.19.3-1.el9sat.noarch",
"product": {
"name": "satellite-cli-0:6.19.3-1.el9sat.noarch",
"product_id": "satellite-cli-0:6.19.3-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.19.3-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow-debugsource@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.12-pillow-debuginfo@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.17.2-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debugsource@1.17.2-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.17.2-3.el9sat?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.18.0.8-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src"
},
"product_reference": "foreman-0:3.18.0.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-debug-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.18.0.2-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.18.0.2-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.18.0.2-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-pcp-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch"
},
"product_reference": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src"
},
"product_reference": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.19.3-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src"
},
"product_reference": "satellite-0:6.19.3-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-capsule-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.18.0.8-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src"
},
"product_reference": "foreman-0:3.18.0.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-cli-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.19.3-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src"
},
"product_reference": "satellite-0:6.19.3-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-0:3.18.0.8-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src"
},
"product_reference": "foreman-0:3.18.0.8-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-cli-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-debug-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-ec2-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.18.0.2-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.18.0.2-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.18.0.2-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-journald-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-libvirt-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-openstack-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-pcp-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-postgresql-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-redis-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-service-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-service-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-telemetry-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-vmware-0:3.18.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch"
},
"product_reference": "foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch"
},
"product_reference": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src"
},
"product_reference": "python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src"
},
"product_reference": "rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src"
},
"product_reference": "rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.20.0.7-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch"
},
"product_reference": "rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.20.0.7-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src"
},
"product_reference": "rubygem-katello-0:4.20.0.7-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64 as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.19.3-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src"
},
"product_reference": "satellite-0:6.19.3-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch"
},
"product_reference": "satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src as a component of Red Hat Satellite 6.19 for RHEL 9",
"product_id": "9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-12515",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-06-17T11:37:24.783000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489812"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Katello\u0027s of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "katello: missing repository authorization in content_uploads exposes cross-product content existence",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects Katello\u0027s content upload API authorization handling. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.\n\nKatello\u0027s content_uploads API does not properly enforce repository authorization checks when processing upload requests. A user with product-filtered edit_products permissions may query repositories outside their authorized scope and determine whether matching content exists within the Pulp content store.\n\nThe issue arises because the API allows operations against repositories that are not covered by the caller\u0027s product-scoped permissions. The response behavior may disclose whether matching content already exists, potentially revealing information about content associated with repositories that would otherwise be inaccessible to the user.\n\nBecause the impact is limited to disclosure of repository information, Red Hat assessed the Confidentiality impact as Low (C:L), with no demonstrated Integrity or Availability impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12515"
},
{
"category": "external",
"summary": "RHBZ#2489812",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489812"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515"
},
{
"category": "external",
"summary": "https://github.com/Katello/katello/pull/11712",
"url": "https://github.com/Katello/katello/pull/11712"
}
],
"release_date": "2026-06-17T15:27:46.078000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "katello: missing repository authorization in content_uploads exposes cross-product content existence"
},
{
"cve": "CVE-2026-54059",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-06T20:02:21.640821+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Python Pillow library. The PcfFontFile._load_bitmaps() method reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation, leading to a denial of service condition. An attacker could exploit this by providing a specially crafted PCF font file to an application that uses Pillow\u0027s font loading functionality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54059"
},
{
"category": "external",
"summary": "RHBZ#2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"
}
],
"release_date": "2026-07-06T18:46:09.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "workaround",
"details": "Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability.",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted PCF font data"
},
{
"cve": "CVE-2026-54060",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-07-06T20:02:29.509113+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497466"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library\u0027s font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Pillow prior to version 12.3.0. The FontFile.compile() method in PIL/FontFile.py assembles per-glyph images into a combined bitmap using Image.new() without calling Image._decompression_bomb_check(). This allows a specially crafted font file to trigger excessive memory allocation during conversion or saving, leading to denial of service via resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54060"
},
{
"category": "external",
"summary": "RHBZ#2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54060"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"
}
],
"release_date": "2026-07-06T18:49:23.788000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files"
},
{
"cve": "CVE-2026-54297",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-24T17:01:10.032866+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492252"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application\u0027s processing thread or worker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "faraday: Faraday: Denial of Service via crafted nested query strings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as applications utilizing the Faraday HTTP client library in Red Hat products are susceptible to a denial of service. A remote attacker can send a specially crafted nested query string, causing the Faraday::NestedParamsEncoder to create an overly deep data structure. This unbounded recursion exhausts system resources, leading to a SystemStackError and crashing the application\u0027s processing thread.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54297"
},
{
"category": "external",
"summary": "RHBZ#2492252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492252"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54297"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297"
},
{
"category": "external",
"summary": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r",
"url": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r"
}
],
"release_date": "2026-06-24T15:50:08.949000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "faraday: Faraday: Denial of Service via crafted nested query strings"
},
{
"cve": "CVE-2026-55379",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-06T20:01:29.922515+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497452"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library\u0027s image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55379"
},
{
"category": "external",
"summary": "RHBZ#2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
}
],
"release_date": "2026-07-06T18:52:11.633000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "workaround",
"details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted BDF font file"
},
{
"cve": "CVE-2026-55380",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-07-06T20:01:42.245051+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497455"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial-of-service vulnerability was found in Pillow\u0027s GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55380"
},
{
"category": "external",
"summary": "RHBZ#2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55380"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
"url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
}
],
"release_date": "2026-07-06T18:50:14.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "workaround",
"details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file"
},
{
"cve": "CVE-2026-57236",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-06-25T15:02:37.352778+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document\u0027s current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as Nokogiri\u0027s CRuby implementation in Red Hat products is vulnerable to a use-after-free when processing invalid encoding values. A remote unauthenticated attacker can trigger a segmentation fault causing denial of service, or leak freed memory contents into a Ruby String causing information disclosure, by providing crafted input that causes an invalid encoding to be set on a document.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57236"
},
{
"category": "external",
"summary": "RHBZ#2492952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57236"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236"
},
{
"category": "external",
"summary": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p",
"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p"
}
],
"release_date": "2026-06-25T14:29:14.181000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50221"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.19-capsule:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19-capsule:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19-capsule:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19-capsule:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19-capsule:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-capsule:satellite-capsule-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-capsule:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19-utils:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19-utils:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19-utils:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19-utils:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-0:3.18.0.8-1.el9sat.src",
"9Base-satellite-6.19:foreman-cli-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-debug-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-dynflow-sidekiq-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-ec2-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-installer-1:3.18.0.2-1.el9sat.src",
"9Base-satellite-6.19:foreman-installer-katello-1:3.18.0.2-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-journald-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-libvirt-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-openstack-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-pcp-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-postgresql-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-redis-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-service-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-telemetry-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:foreman-vmware-0:3.18.0.8-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.19:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.19:python3.12-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.noarch",
"9Base-satellite-6.19:python3.12-pulp-rpm-0:3.32.10-1.el9pc.src",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_openscap-0:12.1.2-1.el9sat.src",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-foreman_rh_cloud-0:13.2.10-1.el9sat.src",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.noarch",
"9Base-satellite-6.19:rubygem-katello-0:4.20.0.7-1.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.src",
"9Base-satellite-6.19:rubygem-nokogiri-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debuginfo-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:rubygem-nokogiri-debugsource-0:1.17.2-3.el9sat.x86_64",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-0:6.19.3-1.el9sat.src",
"9Base-satellite-6.19:satellite-cli-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-common-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:satellite-obsolete-packages-0:6.19.3-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.19:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling"
}
]
}
RHSA-2026:50222
Vulnerability from csaf_redhat - Published: 2026-08-04 16:01 - Updated: 2026-09-10 10:01Summary
Red Hat Security Advisory: Satellite 6.17.10 Async Update
Severity
Important
Notes
Topic: A new release is now available for Red Hat Satellite 6.17 for RHEL 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* puppet-agent: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515)
* puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)
* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)
* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)
* rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* API endpoint GET /api/host_packages/installed_packages in apidoc is wrong (SAT-48096)
* Unable to save bookmark report under Hosts > All Hosts > Compliance > Reports (SAT-48150)
* Update of scap-security-guide-satellite package sources (SAT-48147)
* Switch Satellite 6.17 to OpenVox (SAT-44867)
* Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync (SAT-48303)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).
5.6 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.
4.3 (Medium)
Affected products
Fixed
2 products
Known not affected
69 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Vendor Fix
fix
|
Known not affected
65 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
63 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
|
Known not affected
63 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — | ||
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Threats
Impact
Important
A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application's processing thread or worker.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
Known not affected
67 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
63 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
63 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document's current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.
6.5 (Medium)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
63 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src | — |
Workaround
|
Threats
Impact
Moderate
References
71 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new release is now available for Red Hat Satellite 6.17 for RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* puppet-agent: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230)\n\n* rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515)\n\n* puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)\n\n* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)\n\n* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)\n\n* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)\n\n* rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)\n\n* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)\n\n* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)\n\n* rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nBug Fix(es):\n\n* API endpoint GET /api/host_packages/installed_packages in apidoc is wrong (SAT-48096)\n\n* Unable to save bookmark report under Hosts \u003e All Hosts \u003e Compliance \u003e Reports (SAT-48150)\n\n* Update of scap-security-guide-satellite package sources (SAT-48147)\n\n* Switch Satellite 6.17 to OpenVox (SAT-44867)\n\n* Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence \"container_blobmanifest_id_seq\"\u0027 during container image sync (SAT-48303)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50222",
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "2489812",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489812"
},
{
"category": "external",
"summary": "2492252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492252"
},
{
"category": "external",
"summary": "2492952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492952"
},
{
"category": "external",
"summary": "2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "SAT-44867",
"url": "https://issues.redhat.com/browse/SAT-44867"
},
{
"category": "external",
"summary": "SAT-48096",
"url": "https://issues.redhat.com/browse/SAT-48096"
},
{
"category": "external",
"summary": "SAT-48147",
"url": "https://issues.redhat.com/browse/SAT-48147"
},
{
"category": "external",
"summary": "SAT-48150",
"url": "https://issues.redhat.com/browse/SAT-48150"
},
{
"category": "external",
"summary": "SAT-48303",
"url": "https://issues.redhat.com/browse/SAT-48303"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50222.json"
}
],
"title": "Red Hat Security Advisory: Satellite 6.17.10 Async Update",
"tracking": {
"current_release_date": "2026-09-10T10:01:05+00:00",
"generator": {
"date": "2026-09-10T10:01:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:50222",
"initial_release_date": "2026-08-04T16:01:01+00:00",
"revision_history": [
{
"date": "2026-08-04T16:01:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-05T16:12:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T10:01:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.17::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.17::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-maintenance",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_maintenance:6.17::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.17::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite 6"
},
{
"branches": [
{
"category": "product_version",
"name": "foreman-installer-1:3.14.0.11-1.el9sat.src",
"product": {
"name": "foreman-installer-1:3.14.0.11-1.el9sat.src",
"product_id": "foreman-installer-1:3.14.0.11-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.14.0.11-1.el9sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el9sat.src",
"product": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src",
"product_id": "openvox-agent-0:8.24.1-3.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.src",
"product_id": "openvox-server-0:8.14.1-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pillow-0:12.3.0-1.el9pc.src",
"product": {
"name": "python-pillow-0:12.3.0-1.el9pc.src",
"product_id": "python-pillow-0:12.3.0-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@12.3.0-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pulp-container-0:2.22.10-1.el9pc.src",
"product": {
"name": "python-pulp-container-0:2.22.10-1.el9pc.src",
"product_id": "python-pulp-container-0:2.22.10-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pulp-container@2.22.10-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pyjwt-0:2.13.0-1.el9pc.src",
"product": {
"name": "python-pyjwt-0:2.13.0-1.el9pc.src",
"product_id": "python-pyjwt-0:2.13.0-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pyjwt@2.13.0-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pysequoia-0:0.1.33-1.el9pc.src",
"product": {
"name": "python-pysequoia-0:0.1.33-1.el9pc.src",
"product_id": "python-pysequoia-0:0.1.33-1.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pysequoia@0.1.33-1.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"product": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"product_id": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.10.6-1.el9sat?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"product": {
"name": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"product_id": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_openscap@10.2.2-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.16.0.18-1.el9sat.src",
"product": {
"name": "rubygem-katello-0:4.16.0.18-1.el9sat.src",
"product_id": "rubygem-katello-0:4.16.0.18-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.16.0.18-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.17.10-1.el9sat.src",
"product": {
"name": "satellite-0:6.17.10-1.el9sat.src",
"product_id": "satellite-0:6.17.10-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.17.10-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"product": {
"name": "foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"product_id": "foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer@3.14.0.11-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"product": {
"name": "foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"product_id": "foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/foreman-installer-katello@3.14.0.11-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_id": "openvox-server-0:8.14.1-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-server@8.14.1-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"product": {
"name": "python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"product_id": "python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pulp-container@2.22.10-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product_id": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pyjwt%2Bcrypto@2.13.0-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"product": {
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"product_id": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pyjwt@2.13.0-1.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_id": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-faraday@1.10.6-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"product": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"product_id": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_maintain@1.10.6-1.el9sat?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"product": {
"name": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"product_id": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-foreman_openscap@10.2.2-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"product": {
"name": "rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"product_id": "rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-katello@4.16.0.18-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.17.10-1.el9sat.noarch",
"product": {
"name": "satellite-cli-0:6.17.10-1.el9sat.noarch",
"product_id": "satellite-cli-0:6.17.10-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.17.10-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.17.10-1.el9sat.noarch",
"product": {
"name": "satellite-capsule-0:6.17.10-1.el9sat.noarch",
"product_id": "satellite-capsule-0:6.17.10-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.17.10-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.17.10-1.el9sat.noarch",
"product": {
"name": "satellite-common-0:6.17.10-1.el9sat.noarch",
"product_id": "satellite-common-0:6.17.10-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.17.10-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"product": {
"name": "satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"product_id": "satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-obsolete-packages@6.17.10-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.17.10-1.el9sat.noarch",
"product": {
"name": "satellite-0:6.17.10-1.el9sat.noarch",
"product_id": "satellite-0:6.17.10-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.17.10-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_id": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/scap-security-guide-satellite@1.0.6-1.el9sat?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product_id": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openvox-agent@8.24.1-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pillow@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_id": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_id": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pillow-debuginfo@12.3.0-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product": {
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product_id": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pysequoia@0.1.33-1.el9pc?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debugsource@1.15.7-3.el9sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product_id": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.15.7-3.el9sat?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.14.0.11-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.14.0.11-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.14.0.11-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulp-container-0:2.22.10-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src"
},
"product_reference": "python-pulp-container-0:2.22.10-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pyjwt-0:2.13.0-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src"
},
"product_reference": "python-pyjwt-0:2.13.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysequoia-0:0.1.33-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src"
},
"product_reference": "python-pysequoia-0:0.1.33-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulp-container-0:2.22.10-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch"
},
"product_reference": "python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64"
},
"product_reference": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.17.10-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src"
},
"product_reference": "satellite-0:6.17.10-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-capsule-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-maintenance"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.17.10-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src"
},
"product_reference": "satellite-0:6.17.10-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.14.0.11-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch"
},
"product_reference": "foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-1:3.14.0.11-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src"
},
"product_reference": "foreman-installer-1:3.14.0.11-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch"
},
"product_reference": "foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-agent-0:8.24.1-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64"
},
"product_reference": "openvox-agent-0:8.24.1-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openvox-server-0:8.14.1-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src"
},
"product_reference": "openvox-server-0:8.14.1-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:12.3.0-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src"
},
"product_reference": "python-pillow-0:12.3.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulp-container-0:2.22.10-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src"
},
"product_reference": "python-pulp-container-0:2.22.10-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pyjwt-0:2.13.0-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src"
},
"product_reference": "python-pyjwt-0:2.13.0-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pysequoia-0:0.1.33-1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src"
},
"product_reference": "python-pysequoia-0:0.1.33-1.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
},
"product_reference": "python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulp-container-0:2.22.10-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch"
},
"product_reference": "python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
},
"product_reference": "python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64"
},
"product_reference": "python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-faraday-0:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-faraday-0:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src"
},
"product_reference": "rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch"
},
"product_reference": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src"
},
"product_reference": "rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.16.0.18-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch"
},
"product_reference": "rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-katello-0:4.16.0.18-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src"
},
"product_reference": "rubygem-katello-0:4.16.0.18-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64 as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
},
"product_reference": "rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.17.10-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src"
},
"product_reference": "satellite-0:6.17.10-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch"
},
"product_reference": "satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
"product_id": "9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
},
"product_reference": "scap-security-guide-satellite-0:1.0.6-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.17"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2025-09-17T12:15:34.387000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2396054"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9230"
},
{
"category": "external",
"summary": "RHBZ#2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230"
}
],
"release_date": "2025-09-30T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-12515",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-06-17T11:37:24.783000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489812"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Katello\u0027s of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "katello: missing repository authorization in content_uploads exposes cross-product content existence",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects Katello\u0027s content upload API authorization handling. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.\n\nKatello\u0027s content_uploads API does not properly enforce repository authorization checks when processing upload requests. A user with product-filtered edit_products permissions may query repositories outside their authorized scope and determine whether matching content exists within the Pulp content store.\n\nThe issue arises because the API allows operations against repositories that are not covered by the caller\u0027s product-scoped permissions. The response behavior may disclose whether matching content already exists, potentially revealing information about content associated with repositories that would otherwise be inaccessible to the user.\n\nBecause the impact is limited to disclosure of repository information, Red Hat assessed the Confidentiality impact as Low (C:L), with no demonstrated Integrity or Availability impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12515"
},
{
"category": "external",
"summary": "RHBZ#2489812",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489812"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12515"
},
{
"category": "external",
"summary": "https://github.com/Katello/katello/pull/11712",
"url": "https://github.com/Katello/katello/pull/11712"
}
],
"release_date": "2026-06-17T15:27:46.078000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "katello: missing repository authorization in content_uploads exposes cross-product content existence"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
},
{
"cve": "CVE-2026-54059",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-06T20:02:21.640821+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Python Pillow library. The PcfFontFile._load_bitmaps() method reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation, leading to a denial of service condition. An attacker could exploit this by providing a specially crafted PCF font file to an application that uses Pillow\u0027s font loading functionality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54059"
},
{
"category": "external",
"summary": "RHBZ#2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"
}
],
"release_date": "2026-07-06T18:46:09.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted PCF font data"
},
{
"cve": "CVE-2026-54060",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-07-06T20:02:29.509113+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497466"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library\u0027s font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Pillow prior to version 12.3.0. The FontFile.compile() method in PIL/FontFile.py assembles per-glyph images into a combined bitmap using Image.new() without calling Image._decompression_bomb_check(). This allows a specially crafted font file to trigger excessive memory allocation during conversion or saving, leading to denial of service via resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54060"
},
{
"category": "external",
"summary": "RHBZ#2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54060"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"
}
],
"release_date": "2026-07-06T18:49:23.788000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files"
},
{
"cve": "CVE-2026-54297",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-24T17:01:10.032866+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492252"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application to build an excessively deep data structure. This can lead to a SystemStackError, resulting in a Denial of Service (DoS) by crashing the application\u0027s processing thread or worker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "faraday: Faraday: Denial of Service via crafted nested query strings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as applications utilizing the Faraday HTTP client library in Red Hat products are susceptible to a denial of service. A remote attacker can send a specially crafted nested query string, causing the Faraday::NestedParamsEncoder to create an overly deep data structure. This unbounded recursion exhausts system resources, leading to a SystemStackError and crashing the application\u0027s processing thread.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54297"
},
{
"category": "external",
"summary": "RHBZ#2492252",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492252"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54297"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297"
},
{
"category": "external",
"summary": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r",
"url": "https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r"
}
],
"release_date": "2026-06-24T15:50:08.949000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "faraday: Faraday: Denial of Service via crafted nested query strings"
},
{
"cve": "CVE-2026-55379",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-06T20:01:29.922515+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497452"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library\u0027s image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55379"
},
{
"category": "external",
"summary": "RHBZ#2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
}
],
"release_date": "2026-07-06T18:52:11.633000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted BDF font file"
},
{
"cve": "CVE-2026-55380",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-07-06T20:01:42.245051+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497455"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial-of-service vulnerability was found in Pillow\u0027s GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55380"
},
{
"category": "external",
"summary": "RHBZ#2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55380"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
"url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
}
],
"release_date": "2026-07-06T18:50:14.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file"
},
{
"cve": "CVE-2026-57236",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-06-25T15:02:37.352778+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Nokogiri, an XML and HTML library for Ruby. When an attacker provides an invalid encoding to the Document#encoding= function, the library frees the document\u0027s current encoding string without replacing it. This leaves the document referencing freed memory, which can lead to a denial of service (DoS) due to a segmentation fault or information disclosure by leaking freed memory into a Ruby String.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as Nokogiri\u0027s CRuby implementation in Red Hat products is vulnerable to a use-after-free when processing invalid encoding values. A remote unauthenticated attacker can trigger a segmentation fault causing denial of service, or leak freed memory contents into a Ruby String causing information disclosure, by providing crafted input that causes an invalid encoding to be set on a document.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
],
"known_not_affected": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57236"
},
{
"category": "external",
"summary": "RHBZ#2492952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57236"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57236"
},
{
"category": "external",
"summary": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p",
"url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p"
}
],
"release_date": "2026-06-25T14:29:14.181000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-04T16:01:01+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
"product_ids": [
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50222"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17-capsule:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17-capsule:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17-capsule:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17-capsule:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17-capsule:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17-capsule:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17-maintenance:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17-utils:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:foreman-installer-1:3.14.0.11-1.el9sat.src",
"9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.11-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.src",
"9Base-satellite-6.17:openvox-agent-0:8.24.1-3.el9sat.x86_64",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.noarch",
"9Base-satellite-6.17:openvox-server-0:8.14.1-1.el9sat.src",
"9Base-satellite-6.17:python-pillow-0:12.3.0-1.el9pc.src",
"9Base-satellite-6.17:python-pillow-debugsource-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python-pulp-container-0:2.22.10-1.el9pc.src",
"9Base-satellite-6.17:python-pyjwt-0:2.13.0-1.el9pc.src",
"9Base-satellite-6.17:python-pysequoia-0:0.1.33-1.el9pc.src",
"9Base-satellite-6.17:python3.11-pillow-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pillow-debuginfo-0:12.3.0-1.el9pc.x86_64",
"9Base-satellite-6.17:python3.11-pulp-container-0:2.22.10-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt+crypto-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pyjwt-0:2.13.0-1.el9pc.noarch",
"9Base-satellite-6.17:python3.11-pysequoia-0:0.1.33-1.el9pc.x86_64",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-faraday-0:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_maintain-1:1.10.6-1.el9sat.src",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-foreman_openscap-0:10.2.2-1.el9sat.src",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.noarch",
"9Base-satellite-6.17:rubygem-katello-0:4.16.0.18-1.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.src",
"9Base-satellite-6.17:rubygem-nokogiri-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debuginfo-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:rubygem-nokogiri-debugsource-0:1.15.7-3.el9sat.x86_64",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-0:6.17.10-1.el9sat.src",
"9Base-satellite-6.17:satellite-cli-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-common-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.10-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.noarch",
"9Base-satellite-6.17:scap-security-guide-satellite-0:1.0.6-1.el9sat.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…