Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-39830 (GCVE-0-2026-39830)
Vulnerability from cvelistv5 – Published: 2026-05-22 02:31 – Updated: 2026-08-25 12:05
VLAI
EPSS
VEX
Title
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
Summary
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Severity
9.1 (Critical)
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-22 18:54 UTC
Assigner
References
52 references
Impacted products
66 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| golang.org/x/crypto | golang.org/x/crypto/ssh |
Affected:
0 , < 0.52.0
(semver)
|
guessed | |
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 |
cpe:/a:redhat:assisted_installer:2
|
||
| Red Hat | Confidential Compute Attestation |
cpe:/a:redhat:confidential_compute_attestation:1
|
||
| Red Hat | External Secrets Operator for Red Hat OpenShift |
cpe:/a:redhat:external_secrets_operator:1
|
||
| Red Hat | ExternalDNS Operator |
cpe:/a:redhat:ext_dns_optr:1
|
||
| Red Hat | Logging Subsystem for Red Hat OpenShift |
cpe:/a:redhat:logging:6
|
||
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine
|
||
| Red Hat | OpenShift Pipelines |
cpe:/a:redhat:openshift_pipelines:1
|
||
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1
|
||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 |
cpe:/a:redhat:acm:2
|
||
| Red Hat | Red Hat Advanced Cluster Security 4 |
cpe:/a:redhat:advanced_cluster_security:4
|
||
| Red Hat | Red Hat Ceph Storage 9 |
cpe:/a:redhat:ceph_storage:9
|
||
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
||
| Red Hat | Red Hat OpenShift Dev Spaces |
cpe:/a:redhat:openshift_devspaces:3
|
||
| Red Hat | Red Hat OpenShift for Windows Containers |
cpe:/a:redhat:windows_machine_config
|
||
| Red Hat | Red Hat OpenStack Platform 16.2 |
cpe:/a:redhat:openstack:16.2
|
||
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1
|
||
| Red Hat | Red Hat Quay 3 |
cpe:/a:redhat:quay:3
|
||
| Red Hat | Red Hat Trusted Artifact Signer |
cpe:/a:redhat:trusted_artifact_signer:1
|
||
| Red Hat | Security Profiles Operator |
cpe:/a:redhat:openshift_security_profiles_operator:1
|
||
| Red Hat | Zero Trust Workload Identity Manager |
cpe:/a:redhat:zero_trust_workload_identity_manager:1
|
||
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview |
cpe:/a:redhat:zero_trust_workload_identity_manager:0
|
||
| Red Hat | RHEM 1.1 for RHEL 10 |
cpe:/a:redhat:edge_manager:1.1::el10
|
||
| Red Hat | Cryostat 4 on RHEL 9 |
cpe:/a:redhat:cryostat:4::el9
|
||
| Red Hat | RHEM 1.0 for RHEL 9 |
cpe:/a:redhat:edge_manager:1.0::el9
|
||
| Red Hat | RHEM 1.1 for RHEL 9 |
cpe:/a:redhat:edge_manager:1.1::el9
|
||
| Red Hat | DevWorkspace Operator 0.42 |
cpe:/a:redhat:devworkspace:0.42::el9
|
||
| Red Hat | OpenShift API for Data Protection 1.3 |
cpe:/a:redhat:openshift_api_data_protection:1.3::el9
|
||
| Red Hat | OpenShift API for Data Protection 1.6 |
cpe:/a:redhat:openshift_api_data_protection:1.6::el9
|
||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 |
cpe:/a:redhat:acm:2.16::el9
|
||
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 |
cpe:/a:redhat:advanced_cluster_security:4.10::el8
|
||
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.11 |
cpe:/a:redhat:advanced_cluster_security:4.11::el9
|
||
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.9 |
cpe:/a:redhat:advanced_cluster_security:4.9::el8
|
||
| Red Hat | Red Hat Edge Manager 1.0 |
cpe:/a:redhat:edge_manager:1.0::el9
|
||
| Red Hat | Red Hat Edge Manager 1.1 |
cpe:/a:redhat:edge_manager:1.1::el10
|
||
| Red Hat | Red Hat OpenShift AI 3.3 |
cpe:/a:redhat:openshift_ai:3.3::el9
|
||
| Red Hat | Red Hat OpenShift Builds 1.7.3 |
cpe:/a:redhat:openshift_builds:1.7::el9
|
||
| Red Hat | Red Hat OpenShift Builds 1.8.1 |
cpe:/a:redhat:openshift_builds:1.8::el9
|
||
| Red Hat | Red Hat OpenShift GitOps 1.19 |
cpe:/a:redhat:openshift_gitops:1.19::el8
|
||
| Red Hat | Red Hat OpenShift GitOps 1.2 |
cpe:/a:redhat:openshift_gitops:1.20::el9
|
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
cpe:/a:redhat:openshift_data_foundation:4.22::el9
|
||
| Red Hat | Red Hat Quay 3.12 |
cpe:/a:redhat:quay:3.12::el8
|
||
| Red Hat | Red Hat Quay 3.15 |
cpe:/a:redhat:quay:3.15::el8
|
||
| Red Hat | Red Hat Quay 3.16 |
cpe:/a:redhat:quay:3.16::el9
|
||
| Red Hat | Red Hat Quay 3.1 |
cpe:/a:redhat:quay:3.10::el8
|
||
| Red Hat | Red Hat Quay 3.9 |
cpe:/a:redhat:quay:3.9::el8
|
||
| Red Hat | Red Hat Trusted Artifact Signer 1.3 |
cpe:/a:redhat:trusted_artifact_signer:1.3::el9
|
||
| Red Hat | Red Hat Trusted Artifact Signer 1.4 |
cpe:/a:redhat:trusted_artifact_signer:1.4::el9
|
||
| Red Hat | multicluster engine for Kubernetes 2.10 |
cpe:/a:redhat:multicluster_engine:2.10::el9
|
||
| Red Hat | multicluster engine for Kubernetes 2.11.0 |
cpe:/a:redhat:multicluster_engine:2.11::el9
|
||
| Red Hat | multicluster engine for Kubernetes 2.8 |
cpe:/a:redhat:multicluster_engine:2.8::el9
|
||
| Red Hat | OpenShift API for Data Protection |
cpe:/a:redhat:openshift_api_data_protection:1
|
||
| Red Hat | Red Hat Openshift Data Foundation 4 |
cpe:/a:redhat:openshift_data_foundation:4
|
||
| Red Hat | Red Hat OpenShift GitOps |
cpe:/a:redhat:openshift_gitops:1
|
||
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4
|
||
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0
|
||
| Red Hat | Red Hat Enterprise Linux AppStream (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2
|
||
| Red Hat | Red Hat Enterprise Linux AppStream (v. 8) |
cpe:/a:redhat:enterprise_linux:8::appstream
|
||
| Red Hat | Red Hat Enterprise Linux AppStream E4S (v.8.8) |
cpe:/a:redhat:rhel_e4s:8.8::appstream
|
||
| Red Hat | Red Hat Enterprise Linux AppStream TUS (v.8.8) |
cpe:/a:redhat:rhel_tus:8.8::appstream
|
||
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) |
cpe:/a:redhat:enterprise_linux:9::appstream
|
||
| Red Hat | Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2
|
||
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 |
cpe:/a:redhat:cert_manager:1.19::el9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-39830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-22T18:54:26.306252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T18:54:54.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:assisted_installer:2"
],
"defaultStatus": "affected",
"packageName": "assisted/agent-preinstall-image-builder-rhel9",
"product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"packageName": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "affected",
"packageName": "external-secrets-operator/external-secrets-rhel9",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ext_dns_optr:1"
],
"defaultStatus": "affected",
"packageName": "edo/external-dns-rhel9",
"product": "ExternalDNS Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/cluster-logging-rhel9-operator",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "affected",
"packageName": "multicluster-engine/assisted-service-8-rhel8",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"packageName": "openshift-pipelines/pipelines-chains-controller-rhel9",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-plugin-func-func-util-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "affected",
"packageName": "rhacm2/acm-must-gather-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-rhel8-operator",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
],
"defaultStatus": "affected",
"packageName": "rhceph/alloy-rhel10",
"product": "Red Hat Ceph Storage 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "microshift",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "affected",
"packageName": "devspaces/traefik-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:windows_machine_config"
],
"defaultStatus": "affected",
"packageName": "openshift4-wincw/windows-machine-config-operator-bundle",
"product": "Red Hat OpenShift for Windows Containers",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "affected",
"packageName": "rhosp-rhel8/osp-director-operator",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "affected",
"packageName": "rhosp-rhel9/osp-director-operator",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"packageName": "quay/quay-builder-rhel8",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/ec-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_security_profiles_operator:1"
],
"defaultStatus": "affected",
"packageName": "compliance/openshift-security-profiles-operator-bundle",
"product": "Security Profiles Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:1"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
"product": "Zero Trust Workload Identity Manager",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.1::el10"
],
"defaultStatus": "unaffected",
"packageName": "flightctl-agent-0:1.1.3-1.el10em.aarch64",
"product": "RHEM 1.1 for RHEL 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "unaffected",
"packageName": "cryostat/cryostat-agent-init-rhel9@sha256:56a21c05b7e6face6abbb05a1165d02640779cda3dc829e21237840e7cbac579_amd64",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.0::el9"
],
"defaultStatus": "unaffected",
"packageName": "flightctl-agent-0:1.0.3-1.el9em.aarch64",
"product": "RHEM 1.0 for RHEL 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "flightctl-agent-0:1.1.3-1.el9em.aarch64",
"product": "RHEM 1.1 for RHEL 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:devworkspace:0.42::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:2a263321d0db82af2c030c7035349d3b42378fb3b03c3e58c0553ce68217581b_amd64",
"product": "DevWorkspace Operator 0.42",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.3::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64",
"product": "OpenShift API for Data Protection 1.3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.6::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le",
"product": "OpenShift API for Data Protection 1.6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/rhacm2/volsync-operator-bundle@sha256:29848647ba1965c23a770975538c66974406466a4d4c64c930d2ac911b5bd93f_amd64",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.10::el8"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:05dd53e6127b9002119c9b45837f57a741aaee7675274f97bd23c85303b24c95_amd64",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.11::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:70dbc4b2fd02c6006d01fd31277c79e1152a04e678316853cc9650004a88c8f6_arm64",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.11",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4.9::el8"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:42ce9a730012343eec85c5b69eb163311580df4682de47ca435043dff92c2dda_amd64",
"product": "Red Hat Advanced Cluster Security for Kubernetes 4.9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.0::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel9@sha256:7e7958da7226d0bb3b19bc1447e8545d7d96988d0bde589fbdd649e011586a95_amd64",
"product": "Red Hat Edge Manager 1.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.1::el10"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:46f199ef17120950d7e93c7a961f84d2323d8a5c43f5011e6ae627d345e0b068_arm64",
"product": "Red Hat Edge Manager 1.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:0103822a274ffd4f228c0085d8b8df00a0c893f2f8d0587b7bcd6967dc86cf35_arm64",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_builds:1.7::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:09fdae42b81088e67a3f29e32ac980d57652d8ddbe9665b86aab69b37a4327bd_arm64",
"product": "Red Hat OpenShift Builds 1.7.3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_builds:1.8::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:0ac4f867b4fbd7035b9b7a6158c134c091946383f3d739aeec71ff15f286f5dd_s390x",
"product": "Red Hat OpenShift Builds 1.8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.19::el8"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:2d046fc4a4abd29189af3a8d01eeb9ba38261fa30cb5adfdeac54f5fa5cb5305_s390x",
"product": "Red Hat OpenShift GitOps 1.19",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.20::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:00ab3f1c310b9d271fcd443b55ac584b16eed918110248ca93ea70f31f920dd3_s390x",
"product": "Red Hat OpenShift GitOps 1.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:0436c7a77f0639a173de3fea3420fb61629aaa5e6ec38ebce2eb3b75970e9965_amd64",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/quay/clair-rhel8@sha256:18a8f8eb323f7a2e990f5ba912b811d849f849bcc83071f9c75fe3e098061692_arm64",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/quay/clair-rhel9@sha256:7df4998918f382d98fa22a78f6390cd74fc61f7c4bdfebfcc521223012e58f94_ppc64le",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/quay/clair-rhel8@sha256:2b0948a125eb22fdbcebdd668049aaac225079a75583ddf06e4e49182f377a83_amd64",
"product": "Red Hat Quay 3.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/quay/clair-rhel8@sha256:381f3af2c038cb3a0d14191c1a541cc7e9752698ed3980dcd33ee91ef3752517_s390x",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:b713256acad58c623920da912e3442803a4c6d2f7354d532ff3f772740fe86ab_amd64",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"defaultStatus": "unaffected",
"packageName": "conforma-cli-stack-v1-4@amd64",
"product": "Red Hat Trusted Artifact Signer 1.4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:136c6a753e310e7e6809ced784d2d5226947b97bc98e07e6792d2a7ce972660b_s390x",
"product": "multicluster engine for Kubernetes 2.10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:0451628c58cb6738977a1a5499f204b07e8ab02b41e949b27b263fea3ea61f88_amd64",
"product": "multicluster engine for Kubernetes 2.11.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:5a0702c3c3d088bb774c5b0e9cc2e48d92581d33a10446a05f18c72f6df837b9_arm64",
"product": "multicluster engine for Kubernetes 2.8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1"
],
"defaultStatus": "unaffected",
"packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
"product": "OpenShift API for Data Protection",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "trustee-kbs",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "cri-o",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "ocs4/cephcsi-rhel8",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "unaffected",
"packageName": "openshift-gitops-1/argocd-agent-rhel8",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "container-native-virtualization/virt-api-rhel9",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "unaffected",
"packageName": "golang-golangorg-crypto-devel",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "unaffected",
"packageName": "rhosp-rhel9/osp-director-agent",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "unaffected",
"packageName": "rhoso-operators/octavia-rhel9-operator",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "buildah-2:1.43.1-3.el10_2.aarch64",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "unaffected",
"packageName": "aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.aarch64 (container-tools:rhel8)",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream"
],
"defaultStatus": "unaffected",
"packageName": "aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le (container-tools:rhel8)",
"product": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "unaffected",
"packageName": "aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src (container-tools:rhel8)",
"product": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "unaffected",
"packageName": "buildah-2:1.43.1-2.el9_8.aarch64",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "podman-debugsource-7:5.8.2-4.el10_2.aarch64",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cert_manager:1.19::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:0e4493d95443c137e4fe2e5b81cdf3d6a9b7b5d74c9162c3f32909a331dc07f2_amd64",
"product": "Cert Manager support for Red Hat OpenShift release 1.19",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-22T02:31:27.208Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T12:05:50.288Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"name": "RHBZ#2480684",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41019"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:48151"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36199"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37072"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35833"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49944"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29455"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54531"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36808"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43692"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54400"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36625"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36207"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36319"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36651"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40945"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40118"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37275"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36648"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41036"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52857"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52910"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37387"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42146"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41031"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40972"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40974"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40969"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36797"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37271"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37268"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37272"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37278"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37286"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37296"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:46885"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57194"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47735"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:48151: Cryostat 4 on RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:36796: RHEM 1.0 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:36199: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:37072: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:35833: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:49944: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:29455: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19"
},
{
"lang": "en",
"value": "RHSA-2026:36808: DevWorkspace Operator 0.42"
},
{
"lang": "en",
"value": "RHSA-2026:51033: OpenShift API for Data Protection 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:43692: OpenShift API for Data Protection 1.6"
},
{
"lang": "en",
"value": "RHSA-2026:54400: Red Hat Advanced Cluster Management for Kubernetes 2.16"
},
{
"lang": "en",
"value": "RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10"
},
{
"lang": "en",
"value": "RHSA-2026:36207: Red Hat Advanced Cluster Security for Kubernetes 4.11"
},
{
"lang": "en",
"value": "RHSA-2026:36319: Red Hat Advanced Cluster Security for Kubernetes 4.9"
},
{
"lang": "en",
"value": "RHSA-2026:36651: Red Hat Edge Manager 1.0"
},
{
"lang": "en",
"value": "RHSA-2026:40945: Red Hat Edge Manager 1.1"
},
{
"lang": "en",
"value": "RHSA-2026:40118: Red Hat Edge Manager 1.1"
},
{
"lang": "en",
"value": "RHSA-2026:37275: Red Hat OpenShift AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.3"
},
{
"lang": "en",
"value": "RHSA-2026:41036: Red Hat OpenShift Builds 1.8.1"
},
{
"lang": "en",
"value": "RHSA-2026:52857: Red Hat OpenShift GitOps 1.19"
},
{
"lang": "en",
"value": "RHSA-2026:52910: Red Hat OpenShift GitOps 1.2"
},
{
"lang": "en",
"value": "RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:42146: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:43052: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:42796: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:41066: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:41031: Red Hat Quay 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:40262: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:40972: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:40974: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:40969: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:37271: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:37268: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:37278: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:37286: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:37296: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:46885: multicluster engine for Kubernetes 2.10"
},
{
"lang": "en",
"value": "RHSA-2026:57194: multicluster engine for Kubernetes 2.11.0"
},
{
"lang": "en",
"value": "RHSA-2026:47735: multicluster engine for Kubernetes 2.8"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-22T04:01:38.517Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-22T02:31:27.208Z",
"value": "Made public."
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/crypto/ssh",
"product": "golang.org/x/crypto/ssh",
"programRoutines": [
{
"name": "mux.SendRequest"
},
{
"name": "mux.handleGlobalPacket"
},
{
"name": "channel.handlePacket"
},
{
"name": "channel.SendRequest"
},
{
"name": "Client.Listen"
},
{
"name": "Client.ListenTCP"
},
{
"name": "Client.ListenUnix"
},
{
"name": "Dial"
},
{
"name": "NewClientConn"
},
{
"name": "NewServerConn"
},
{
"name": "Session.CombinedOutput"
},
{
"name": "Session.Output"
},
{
"name": "Session.RequestPty"
},
{
"name": "Session.RequestSubsystem"
},
{
"name": "Session.Run"
},
{
"name": "Session.SendRequest"
},
{
"name": "Session.Setenv"
},
{
"name": "Session.Shell"
},
{
"name": "Session.Signal"
},
{
"name": "Session.Start"
},
{
"name": "Session.WindowChange"
},
{
"name": "tcpListener.Close"
},
{
"name": "unixListener.Close"
}
],
"vendor": "golang.org/x/crypto",
"versions": [
{
"lessThan": "0.52.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "NCC Group Cryptography Services, sponsored by Teleport"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-833: Deadlock",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T02:31:27.208Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/79564"
},
{
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"url": "https://go.dev/cl/781640"
},
{
"url": "https://go.dev/cl/781664"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"title": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-39830",
"datePublished": "2026-05-22T02:31:27.208Z",
"dateReserved": "2026-04-07T18:13:03.528Z",
"dateUpdated": "2026-08-25T12:05:50.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-39830",
"date": "2026-08-25",
"epss": "0.00621",
"percentile": "0.47115"
},
"microsoft_vex": {
"current_release_date": "2026-06-03T01:48:10.000Z",
"cve": "CVE-2026-39830",
"id": "msrc_CVE-2026-39830",
"initial_release_date": "2026-05-02T00:00:00.000Z",
"product_status:fixed": "13",
"product_status:known_affected": "13",
"product_status:known_not_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-39830.json",
"version": "6"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-39830\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-05-22T04:16:22.440\",\"lastModified\":\"2026-08-25T13:18:49.913\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.\"},{\"lang\":\"es\",\"value\":\"Un par SSH malicioso podr\u00eda enviar respuestas de solicitud global no solicitadas para llenar un b\u00fafer interno, bloqueando el bucle de lectura de la conexi\u00f3n. La goroutine bloqueada no podr\u00eda ser liberada al llamar a Close(), lo que resultar\u00eda en una fuga de recursos por conexi\u00f3n. Las respuestas globales no solicitadas ahora se descartan.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"golang.org/x/crypto\",\"product\":\"golang.org/x/crypto/ssh\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"golang.org/x/crypto/ssh\",\"programRoutines\":[{\"name\":\"mux.SendRequest\"},{\"name\":\"mux.handleGlobalPacket\"},{\"name\":\"channel.handlePacket\"},{\"name\":\"channel.SendRequest\"},{\"name\":\"Client.Listen\"},{\"name\":\"Client.ListenTCP\"},{\"name\":\"Client.ListenUnix\"},{\"name\":\"Dial\"},{\"name\":\"NewClientConn\"},{\"name\":\"NewServerConn\"},{\"name\":\"Session.CombinedOutput\"},{\"name\":\"Session.Output\"},{\"name\":\"Session.RequestPty\"},{\"name\":\"Session.RequestSubsystem\"},{\"name\":\"Session.Run\"},{\"name\":\"Session.SendRequest\"},{\"name\":\"Session.Setenv\"},{\"name\":\"Session.Shell\"},{\"name\":\"Session.Signal\"},{\"name\":\"Session.Start\"},{\"name\":\"Session.WindowChange\"},{\"name\":\"tcpListener.Close\"},{\"name\":\"unixListener.Close\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.52.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Assisted Installer for Red Hat OpenShift Container Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"assisted/agent-preinstall-image-builder-rhel9\",\"cpes\":[\"cpe:/a:redhat:assisted_installer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"external-secrets-operator/external-secrets-rhel9\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"ExternalDNS Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"edo/external-dns-rhel9\",\"cpes\":[\"cpe:/a:redhat:ext_dns_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/cluster-logging-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:logging:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/assisted-service-8-rhel8\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-pipelines/pipelines-chains-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-serverless-1/kn-plugin-func-func-util-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhacm2/acm-must-gather-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"advanced-cluster-security/rhacs-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhceph/alloy-rhel10\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"microshift\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/traefik-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift for Windows Containers\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift4-wincw/windows-machine-config-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:windows_machine_config\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhosp-rhel8/osp-director-operator\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhosp-rhel9/osp-director-operator\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-builder-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/ec-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Security Profiles Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"compliance/openshift-security-profiles-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:openshift_security_profiles_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"RHEM 1.1 for RHEL 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"flightctl-agent-0:1.1.3-1.el10em.aarch64\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.1::el10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cryostat/cryostat-agent-init-rhel9@sha256:56a21c05b7e6face6abbb05a1165d02640779cda3dc829e21237840e7cbac579_amd64\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"RHEM 1.0 for RHEL 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"flightctl-agent-0:1.0.3-1.el9em.aarch64\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"RHEM 1.1 for RHEL 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"flightctl-agent-0:1.1.3-1.el9em.aarch64\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"DevWorkspace Operator 0.42\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:2a263321d0db82af2c030c7035349d3b42378fb3b03c3e58c0553ce68217581b_amd64\",\"cpes\":[\"cpe:/a:redhat:devworkspace:0.42::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.6::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.16\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/rhacm2/volsync-operator-bundle@sha256:29848647ba1965c23a770975538c66974406466a4d4c64c930d2ac911b5bd93f_amd64\",\"cpes\":[\"cpe:/a:redhat:acm:2.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:05dd53e6127b9002119c9b45837f57a741aaee7675274f97bd23c85303b24c95_amd64\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.11\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:70dbc4b2fd02c6006d01fd31277c79e1152a04e678316853cc9650004a88c8f6_arm64\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security for Kubernetes 4.9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:42ce9a730012343eec85c5b69eb163311580df4682de47ca435043dff92c2dda_amd64\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/rhem/flightctl-alert-exporter-rhel9@sha256:7e7958da7226d0bb3b19bc1447e8545d7d96988d0bde589fbdd649e011586a95_amd64\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.0::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:46f199ef17120950d7e93c7a961f84d2323d8a5c43f5011e6ae627d345e0b068_arm64\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.1::el10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:0103822a274ffd4f228c0085d8b8df00a0c893f2f8d0587b7bcd6967dc86cf35_arm64\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.7.3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:09fdae42b81088e67a3f29e32ac980d57652d8ddbe9665b86aab69b37a4327bd_arm64\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.7::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:0ac4f867b4fbd7035b9b7a6158c134c091946383f3d739aeec71ff15f286f5dd_s390x\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.19\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:2d046fc4a4abd29189af3a8d01eeb9ba38261fa30cb5adfdeac54f5fa5cb5305_s390x\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.19::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:00ab3f1c310b9d271fcd443b55ac584b16eed918110248ca93ea70f31f920dd3_s390x\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.20::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:0436c7a77f0639a173de3fea3420fb61629aaa5e6ec38ebce2eb3b75970e9965_amd64\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/quay/clair-rhel8@sha256:18a8f8eb323f7a2e990f5ba912b811d849f849bcc83071f9c75fe3e098061692_arm64\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/quay/clair-rhel9@sha256:7df4998918f382d98fa22a78f6390cd74fc61f7c4bdfebfcc521223012e58f94_ppc64le\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/quay/clair-rhel8@sha256:2b0948a125eb22fdbcebdd668049aaac225079a75583ddf06e4e49182f377a83_amd64\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/quay/clair-rhel8@sha256:381f3af2c038cb3a0d14191c1a541cc7e9752698ed3980dcd33ee91ef3752517_s390x\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:b713256acad58c623920da912e3442803a4c6d2f7354d532ff3f772740fe86ab_amd64\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"conforma-cli-stack-v1-4@amd64\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:136c6a753e310e7e6809ced784d2d5226947b97bc98e07e6792d2a7ce972660b_s390x\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.10::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.11.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:0451628c58cb6738977a1a5499f204b07e8ab02b41e949b27b263fea3ea61f88_amd64\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.11::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"multicluster engine for Kubernetes 2.8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:5a0702c3c3d088bb774c5b0e9cc2e48d92581d33a10446a05f18c72f6df837b9_arm64\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine:2.8::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-engine/hypershift-addon-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"trustee-kbs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cri-o\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocs4/cephcsi-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/argocd-agent-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"container-native-virtualization/virt-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"golang-golangorg-crypto-devel\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhosp-rhel9/osp-director-agent\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoso-operators/octavia-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 10)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"buildah-2:1.43.1-3.el10_2.aarch64\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 8)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.aarch64 (container-tools:rhel8)\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream E4S (v.8.8)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le (container-tools:rhel8)\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream TUS (v.8.8)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src (container-tools:rhel8)\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AppStream (v. 9)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"buildah-2:1.43.1-2.el9_8.aarch64\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman-debugsource-7:5.8.2-4.el10_2.aarch64\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cert Manager support for Red Hat OpenShift release 1.19\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:0e4493d95443c137e4fe2e5b81cdf3d6a9b7b5d74c9162c3f32909a331dc07f2_amd64\",\"cpes\":[\"cpe:/a:redhat:cert_manager:1.19::el9\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-22T18:54:26.306252Z\",\"id\":\"CVE-2026-39830\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-772\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"0.52.0\",\"matchCriteriaId\":\"D540395B-31B8-4B07-8F79-F5C631BBD5C8\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/781640\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://go.dev/cl/781664\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://go.dev/issue/79564\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/a082jnz-LvI\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-5017\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29455\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:35833\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36199\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36207\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36319\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36625\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36648\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36651\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36796\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36797\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36808\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37072\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37268\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37271\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37272\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37275\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37278\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37286\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37296\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37387\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40118\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40262\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40945\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40969\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40972\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:40974\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41019\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41031\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41036\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41066\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42146\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42796\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43052\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43692\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:46885\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47735\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:48151\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:49944\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:51033\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:52857\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:52910\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54400\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54531\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:57194\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-39830\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2480684\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-25T16:19:54+00:00",
"cve": "CVE-2026-39830",
"id": "CVE-2026-39830",
"initial_release_date": "2026-05-22T02:31:27.208000+00:00",
"product_status:fixed": "995",
"product_status:known_affected": "122",
"product_status:known_not_affected": "1928",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:assisted_installer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Assisted Installer for Red Hat OpenShift Container Platform 2\", \"packageName\": \"assisted/agent-preinstall-image-builder-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"packageName\": \"openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"packageName\": \"external-secrets-operator/external-secrets-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ext_dns_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"ExternalDNS Operator\", \"packageName\": \"edo/external-dns-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/cluster-logging-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/assisted-service-8-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"packageName\": \"openshift-pipelines/pipelines-chains-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-plugin-func-func-util-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/acm-must-gather-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-rhel8-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 9\", \"packageName\": \"rhceph/alloy-rhel10\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"microshift\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces\", \"packageName\": \"devspaces/traefik-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:windows_machine_config\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift for Windows Containers\", \"packageName\": \"openshift4-wincw/windows-machine-config-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"packageName\": \"rhosp-rhel8/osp-director-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"rhosp-rhel9/osp-director-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3\", \"packageName\": \"quay/quay-builder-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/ec-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_security_profiles_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Security Profiles Operator\", \"packageName\": \"compliance/openshift-security-profiles-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.1::el10\"], \"vendor\": \"Red Hat\", \"product\": \"RHEM 1.1 for RHEL 10\", \"packageName\": \"flightctl-agent-0:1.1.3-1.el10em.aarch64\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"packageName\": \"cryostat/cryostat-agent-init-rhel9@sha256:56a21c05b7e6face6abbb05a1165d02640779cda3dc829e21237840e7cbac579_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"RHEM 1.0 for RHEL 9\", \"packageName\": \"flightctl-agent-0:1.0.3-1.el9em.aarch64\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"RHEM 1.1 for RHEL 9\", \"packageName\": \"flightctl-agent-0:1.1.3-1.el9em.aarch64\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:devworkspace:0.42::el9\"], \"vendor\": \"Red Hat\", \"product\": \"DevWorkspace Operator 0.42\", \"packageName\": \"registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:2a263321d0db82af2c030c7035349d3b42378fb3b03c3e58c0553ce68217581b_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.3\", \"packageName\": \"registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:31a22af5fb2d2767267b80b3c15dab1ed0c2620eb1d33ffa4c4c24ca57071cf9_arm64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.6\", \"packageName\": \"registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:5f21bd5387a16c9d3b72317884972fd83cd091954f79c4f19df7e2b8c3758e16_ppc64le\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.16\", \"packageName\": \"registry.redhat.io/rhacm2/volsync-operator-bundle@sha256:29848647ba1965c23a770975538c66974406466a4d4c64c930d2ac911b5bd93f_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.10\", \"packageName\": \"registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:05dd53e6127b9002119c9b45837f57a741aaee7675274f97bd23c85303b24c95_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.11\", \"packageName\": \"registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:70dbc4b2fd02c6006d01fd31277c79e1152a04e678316853cc9650004a88c8f6_arm64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security for Kubernetes 4.9\", \"packageName\": \"registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:42ce9a730012343eec85c5b69eb163311580df4682de47ca435043dff92c2dda_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1.0\", \"packageName\": \"registry.redhat.io/rhem/flightctl-alert-exporter-rhel9@sha256:7e7958da7226d0bb3b19bc1447e8545d7d96988d0bde589fbdd649e011586a95_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.1::el10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1.1\", \"packageName\": \"registry.redhat.io/rhem/flightctl-alert-exporter-rhel10@sha256:46f199ef17120950d7e93c7a961f84d2323d8a5c43f5011e6ae627d345e0b068_arm64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"packageName\": \"registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:0103822a274ffd4f228c0085d8b8df00a0c893f2f8d0587b7bcd6967dc86cf35_arm64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.7.3\", \"packageName\": \"registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:09fdae42b81088e67a3f29e32ac980d57652d8ddbe9665b86aab69b37a4327bd_arm64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.8.1\", \"packageName\": \"registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9@sha256:0ac4f867b4fbd7035b9b7a6158c134c091946383f3d739aeec71ff15f286f5dd_s390x\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.19::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.19\", \"packageName\": \"registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:2d046fc4a4abd29189af3a8d01eeb9ba38261fa30cb5adfdeac54f5fa5cb5305_s390x\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.2\", \"packageName\": \"registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:00ab3f1c310b9d271fcd443b55ac584b16eed918110248ca93ea70f31f920dd3_s390x\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"packageName\": \"registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:0436c7a77f0639a173de3fea3420fb61629aaa5e6ec38ebce2eb3b75970e9965_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"packageName\": \"registry.redhat.io/quay/clair-rhel8@sha256:18a8f8eb323f7a2e990f5ba912b811d849f849bcc83071f9c75fe3e098061692_arm64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"packageName\": \"registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"packageName\": \"registry.redhat.io/quay/clair-rhel9@sha256:7df4998918f382d98fa22a78f6390cd74fc61f7c4bdfebfcc521223012e58f94_ppc64le\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.1\", \"packageName\": \"registry.redhat.io/quay/clair-rhel8@sha256:2b0948a125eb22fdbcebdd668049aaac225079a75583ddf06e4e49182f377a83_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"packageName\": \"registry.redhat.io/quay/clair-rhel8@sha256:381f3af2c038cb3a0d14191c1a541cc7e9752698ed3980dcd33ee91ef3752517_s390x\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.3\", \"packageName\": \"registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:b713256acad58c623920da912e3442803a4c6d2f7354d532ff3f772740fe86ab_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.4\", \"packageName\": \"conforma-cli-stack-v1-4@amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.10::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.10\", \"packageName\": \"registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:136c6a753e310e7e6809ced784d2d5226947b97bc98e07e6792d2a7ce972660b_s390x\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.11.0\", \"packageName\": \"registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:0451628c58cb6738977a1a5499f204b07e8ab02b41e949b27b263fea3ea61f88_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine:2.8::el9\"], \"vendor\": \"Red Hat\", \"product\": \"multicluster engine for Kubernetes 2.8\", \"packageName\": \"registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:5a0702c3c3d088bb774c5b0e9cc2e48d92581d33a10446a05f18c72f6df837b9_arm64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection\", \"packageName\": \"multicluster-engine/hypershift-addon-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"trustee-kbs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"cri-o\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"ocs4/cephcsi-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps\", \"packageName\": \"openshift-gitops-1/argocd-agent-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/virt-api-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"packageName\": \"golang-golangorg-crypto-devel\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"rhosp-rhel9/osp-director-agent\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso-operators/octavia-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 10)\", \"packageName\": \"buildah-2:1.43.1-3.el10_2.aarch64\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 8)\", \"packageName\": \"aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.aarch64 (container-tools:rhel8)\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.8)\", \"packageName\": \"aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le (container-tools:rhel8)\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.8)\", \"packageName\": \"aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src (container-tools:rhel8)\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 9)\", \"packageName\": \"buildah-2:1.43.1-2.el9_8.aarch64\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\", \"packageName\": \"podman-debugsource-7:5.8.2-4.el10_2.aarch64\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:cert_manager:1.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cert Manager support for Red Hat OpenShift release 1.19\", \"packageName\": \"registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:0e4493d95443c137e4fe2e5b81cdf3d6a9b7b5d74c9162c3f32909a331dc07f2_amd64\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-22T04:01:38.517Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-22T02:31:27.208Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:48151: Cryostat 4 on RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36796: RHEM 1.0 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36199: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37072: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:35833: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:49944: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29455: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36808: DevWorkspace Operator 0.42\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:51033: OpenShift API for Data Protection 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:43692: OpenShift API for Data Protection 1.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54400: Red Hat Advanced Cluster Management for Kubernetes 2.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36207: Red Hat Advanced Cluster Security for Kubernetes 4.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36319: Red Hat Advanced Cluster Security for Kubernetes 4.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36651: Red Hat Edge Manager 1.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40945: Red Hat Edge Manager 1.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40118: Red Hat Edge Manager 1.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37275: Red Hat OpenShift AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36648: Red Hat OpenShift Builds 1.7.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41036: Red Hat OpenShift Builds 1.8.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:52857: Red Hat OpenShift GitOps 1.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:52910: Red Hat OpenShift GitOps 1.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42146: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:43052: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42796: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41066: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41031: Red Hat Quay 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40262: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40972: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40974: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:40969: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37271: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37268: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37278: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37286: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37296: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:46885: multicluster engine for Kubernetes 2.10\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:57194: multicluster engine for Kubernetes 2.11.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:47735: multicluster engine for Kubernetes 2.8\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-22T02:31:27.208Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-39830\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2480684\", \"name\": \"RHBZ#2480684\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41019\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:48151\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36796\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36199\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37072\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:35833\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:49944\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29455\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54531\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36808\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:51033\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:43692\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54400\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36625\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36207\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36319\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36651\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40945\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40118\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37275\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36648\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41036\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:52857\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:52910\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37387\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42146\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:43052\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42796\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41066\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41031\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40262\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40972\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40974\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:40969\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36797\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37271\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37268\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37272\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37278\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37286\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37296\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:46885\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:57194\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47735\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-772\", \"description\": \"Missing Release of Resource after Effective Lifetime\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-25T12:05:50.288Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-39830\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-22T18:54:26.306252Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-22T18:54:49.174Z\"}}], \"cna\": {\"title\": \"Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\", \"credits\": [{\"lang\": \"en\", \"value\": \"NCC Group Cryptography Services, sponsored by Teleport\"}], \"affected\": [{\"vendor\": \"golang.org/x/crypto\", \"product\": \"golang.org/x/crypto/ssh\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.52.0\", \"versionType\": \"semver\"}], \"packageName\": \"golang.org/x/crypto/ssh\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"mux.SendRequest\"}, {\"name\": \"mux.handleGlobalPacket\"}, {\"name\": \"channel.handlePacket\"}, {\"name\": \"channel.SendRequest\"}, {\"name\": \"Client.Listen\"}, {\"name\": \"Client.ListenTCP\"}, {\"name\": \"Client.ListenUnix\"}, {\"name\": \"Dial\"}, {\"name\": \"NewClientConn\"}, {\"name\": \"NewServerConn\"}, {\"name\": \"Session.CombinedOutput\"}, {\"name\": \"Session.Output\"}, {\"name\": \"Session.RequestPty\"}, {\"name\": \"Session.RequestSubsystem\"}, {\"name\": \"Session.Run\"}, {\"name\": \"Session.SendRequest\"}, {\"name\": \"Session.Setenv\"}, {\"name\": \"Session.Shell\"}, {\"name\": \"Session.Signal\"}, {\"name\": \"Session.Start\"}, {\"name\": \"Session.WindowChange\"}, {\"name\": \"tcpListener.Close\"}, {\"name\": \"unixListener.Close\"}]}], \"references\": [{\"url\": \"https://go.dev/issue/79564\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/a082jnz-LvI\"}, {\"url\": \"https://go.dev/cl/781640\"}, {\"url\": \"https://go.dev/cl/781664\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-5017\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-833: Deadlock\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-05-22T02:31:27.208Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-39830\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T12:05:50.288Z\", \"dateReserved\": \"2026-04-07T18:13:03.528Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-05-22T02:31:27.208Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:59467
Vulnerability from csaf_redhat - Published: 2026-08-25 14:28 - Updated: 2026-08-25 19:04Summary
Red Hat Security Advisory: Red Hat OpenShift API for Data Protection
Severity
Important
Notes
Topic: A new version of OpenShift API for Data Protection (OADP) is now available.
Details: OpenShift API for Data Protection (OADP) enables you to back up and restore
application resources, persistent volume data, and internal container
images to external backup storage. OADP enables both file system-based and
snapshot-based backups for persistent volumes.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.
8.1 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.
7.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.
6.1 (Medium)
Affected products
Fixed
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Threats
Impact
Important
A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Threats
Impact
Important
A flaw was found in Magistrala's Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access to internal databases, and Server-Side Request Forgery (SSRF) against internal microservices. This could lead to significant data compromise and unauthorized system access.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 | — |
Threats
Impact
Important
References
153 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of OpenShift API for Data Protection (OADP) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift API for Data Protection (OADP) enables you to back up and restore\napplication resources, persistent volume data, and internal container\nimages to external backup storage. OADP enables both file system-based and\nsnapshot-based backups for persistent volumes.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:59467",
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39831",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42306",
"url": "https://access.redhat.com/security/cve/CVE-2026-42306"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42502",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44740",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53488",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53492",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-71235",
"url": "https://access.redhat.com/security/cve/CVE-2026-71235"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59467.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift API for Data Protection",
"tracking": {
"current_release_date": "2026-08-25T19:04:08+00:00",
"generator": {
"date": "2026-08-25T19:04:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:59467",
"initial_release_date": "2026-08-25T14:28:30+00:00",
"revision_history": [
{
"date": "2026-08-25T14:28:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-25T14:28:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-25T19:04:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift API for Data Protection 1.4",
"product": {
"name": "OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift API for Data Protection"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1786948756"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1786946006"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1786946294"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1787155883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"product_id": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-operator-bundle@sha256%3A785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-operator-bundle\u0026tag=1787156675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3Ab521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1786944540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1786946116"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1786945377"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Aa8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1786944232"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3A9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1786946223"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1786946268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3A254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1786946190"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1786948756"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Af603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1786946006"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1786946294"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1787155883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1786944540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3Af1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1786946116"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3Acb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1786945377"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1786944232"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3A07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1786946223"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3Ae24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1786946268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3Aa6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1786946190"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1786948756"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Ae2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1786946006"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1786946294"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1787155883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1786944540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3Ad74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1786946116"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3Abd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1786945377"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1786944232"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3Ad9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1786946223"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1786946268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3A91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1786946190"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-cli-binaries-rhel9@sha256%3A05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-cli-binaries-rhel9\u0026tag=1786948756"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1786946006"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3Ab2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1786946294"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1787155883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1786944540"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1786946116"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1786945377"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Abdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1786944232"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3A9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1786946223"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3Ae5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1786946268"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9@sha256%3Aa094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9\u0026tag=1786946190"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64 as a component of OpenShift API for Data Protection 1.4",
"product_id": "OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39831",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-22T04:01:12.861178+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "RHBZ#2480675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://go.dev/cl/781662",
"url": "https://go.dev/cl/781662"
},
{
"category": "external",
"summary": "https://go.dev/issue/79566",
"url": "https://go.dev/issue/79566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5019",
"url": "https://pkg.go.dev/vuln/GO-2026-5019"
}
],
"release_date": "2026-05-22T02:31:27.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42306",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-06-12T19:01:10.843543+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488484"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Moby container framework where a race condition during `docker cp` mount setup could allow a malicious container to overwrite arbitrary host files. Exploitation requires an attacker to have control over a running container, which could lead to data corruption or denial of service on the host system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42306"
},
{
"category": "external",
"summary": "RHBZ#2488484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42306"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42306",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42306"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh",
"url": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"
}
],
"release_date": "2026-06-12T18:09:22.188000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42502",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:11.151484+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480762"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "RHBZ#2480762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
},
{
"category": "external",
"summary": "https://go.dev/cl/781701",
"url": "https://go.dev/cl/781701"
},
{
"category": "external",
"summary": "https://go.dev/issue/79572",
"url": "https://go.dev/issue/79572"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5027",
"url": "https://pkg.go.dev/vuln/GO-2026-5027"
}
],
"release_date": "2026-05-22T15:01:21.649000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-44740",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-01T17:01:53.685793+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483894"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "RHBZ#2483894",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44740",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44740"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
"url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
"url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
},
{
"category": "external",
"summary": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
"url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
}
],
"release_date": "2026-06-01T16:04:50.358000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
},
{
"cve": "CVE-2026-53488",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-07-01T02:01:09.589815+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in containerd where the CRI plugin propagates labels from an image configuration (LABEL instruction in a Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host via a plugin that consumes container labels for operations, such as the restart-monitor binary:// logger. An attacker who can cause a crafted container image to be pulled and run can achieve host-level code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "RHBZ#2495815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"
}
],
"release_date": "2026-07-01T00:11:20.610000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
},
{
"category": "workaround",
"details": "Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin"
},
{
"cve": "CVE-2026-53492",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-01T19:01:34.238078+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496130"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. In Red Hat OpenShift Container Platform, a user with pod creation permissions could bypass standard Kubernetes resource allocation and device plugin enforcement. This is due to containerd\u0027s Container Runtime Interface (CRI) improperly trusting Container Device Interface (CDI) annotations during container restoration. Exploitation requires CDI to be enabled on the node and a matching host CDI specification for the requested device.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "RHBZ#2496130",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496130"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"
}
],
"release_date": "2026-07-01T17:59:12.552000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration."
},
{
"cve": "CVE-2026-71235",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-08-05T12:07:04.533964+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511475"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Magistrala\u0027s Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access to internal databases, and Server-Side Request Forgery (SSRF) against internal microservices. This could lead to significant data compromise and unauthorized system access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/absmach/magistrala: Magistrala IoT Platform: Arbitrary Code Execution via Unrestricted Script Execution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-71235"
},
{
"category": "external",
"summary": "RHBZ#2511475",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511475"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-71235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-71235"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71235",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71235"
},
{
"category": "external",
"summary": "https://github.com/absmach/magistrala",
"url": "https://github.com/absmach/magistrala"
}
],
"release_date": "2026-08-05T10:56:25.198000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-25T14:28:30+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:59467"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:05054881739aac3d6f7fadd2d0df6dbe0971022e86654df8d271dbf524ddd2a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:49d9060816e80f92a26704ecf09b099100a6769fb12fe8d162b296f684d5db5f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:611ec141ca5f61fc4fe6c7f74a6aca2013f89efd26f58663759285baae8cbcec_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:6a21843a583d7d69ed69a5bfd02f6150ff954c90acbc1509df9cd26b9a765ff2_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:07c945f427187424cb7f343c03bc624c81446e0f61cd25caea5240ca3f74fb38_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:46422f786cef9ed4efe40b13af7ba568adadac903481c5f0a4a77e22cea5b74f_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:e2a3c9a554fc977444bb97b2a8a33ff402b1f3ddc295d82536578c4df9eb765e_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f603ccb3f67965797a32ab2953fb8294a7eff079d2e5dccfa38c0b4e9d3223ab_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:05ac094d4e312e3ee6881ce987b4100ca2856655ff5d56fa0e0fde7bbf1ac4ea_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:44b5c718cbb1e5bf0117c2576dc8c9f7d0102bd0f4c3ffe8ee0250ca651e2644_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:5c71577846878600dfce7d003068a180d3af495e89769e6685e4daf930140ea9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:b2129d4689a33a4d8a4a26973c2e6f18658bce7c1e9efb83e63fd29ec47f71a1_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-operator-bundle@sha256:785fe18302f9bde71d6bcbd603773991822ecc0f6a7cd30e8b933dd8fdc025c1_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:0a9a1e3b737b7f01d813bb11df2aa6c6973370a1033f7c634b28857bab7f52e0_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:27f3a6fb5c6e631821ca0876d70f14e251585db68d3b660242841c529552d46a_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6261764c79f56e1f178a8b3cbb771527073d9f76e7fc38d279f90b881183cb3c_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:6509279b3873753948d3f9ea275829d4fb15ba6db6d527d6f8502ef747f0e51b_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:1876085b7a73583343ec55ab681bda68dc919d8434b54c077132fbbcbcc952d6_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:9b85835c5ace2401fdbe205a8847ae7f3bd50839a98d682e9ba67d18818b855e_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:bd8025908869417f6374f38f92c8b460e9d0b076a94dd5c2d20a89af2ce38bf8_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:cb49f13e711da4c2945e7656229e8f1ac92731d24cf140728ddc3bc6f06af96f_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:61c0ac14cd59c749a2ab1254074b710739b7e1f42fcdd2dd3b92b9930f930f44_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:82883c7618903e7ba7b9408f5e80dda19c9bdfb8f13c14b8fe94d50723da707b_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a8b0e3a2ee5876a6047f28737c4e6bbb1397d5d9362e999f797cd57f91d3a285_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:bdc1a6559fcd666677e06ee25f42d8e4817f283d35f0260aa0d237755b39d56f_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:07ed682cae82efe7757024a1e16a5fa46054b460e7efa8bf2ec2a39684b464e9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9561bd529d4fad2d4fff6956432f05054b1ad8a51a7539b1e4a0fb6f18eb1328_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f816497517150c96dcf16acb6b8337d3b52d293d5e69bb3f7eeae2c7a98a8da_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:d9dba07974d38a7e51d89ef64c729c00b830d065989697aed336c1562e40e8df_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:246e7410bf29a2fa82056e1dc00f0f4dfe304f066eca23cc7baabb7d82c382ad_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:3ee039e4498691f089267561a337ce2a9008110752e61f353c108db07c366162_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e24ce3654978cdeb7c344691772ecf1b15cd83e1fa4aae280a6070c2f999e621_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:e5d8be9c09ba64420215a60d59231bb1146107b3327047679828ed073dae8a8d_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:24fe01c0a1078cb5e8446abbbf9a99819e53460b203e053e52690f7343bbf423_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:5032950e198ddbf91d6e868e5f68518f8fef31b4524ceed10fdbcd8470c3772b_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:d74b6c3351c139af2697c2cb53b717256ea77f995a0379800a4a078f936d2cc5_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:f1d8887ea2d3c28f92f838f410c3d7d8208646e13641257b905fe666c61bc7eb_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:254326ce735773e141efc717d4625f6e39fa51debc999eca6fb1770cd83eb2a9_amd64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:91aa53e7cc2a9f3385145595738f53eeba046eef2ad98dba23407a9106aff06a_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a094bb204c8e52669d2ada35254a1d621d6818db95a6350e17f5d3b30b596aa4_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9@sha256:a6330eb366bb976114e42a9d659d7900ad091c81e24df0f217595eaff76fbbb9_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:1b72d359be6440c0f9a5b96626a22360a753331ed2ff7ef0e45fab4848247294_arm64",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:312e38c7f630017e07947994491f3e1a93c479d3ddd5116be932153ff21c6451_s390x",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:52ad5a7db766ff145ed9d04fc986579a115224a7906d375285e6cfe353a6edc3_ppc64le",
"OpenShift API for Data Protection 1.4:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:b521f7f496963cddc710ffaca71e5c8322df776f201f7d54e486ac94f4a62256_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/absmach/magistrala: Magistrala IoT Platform: Arbitrary Code Execution via Unrestricted Script Execution"
}
]
}
SUSE-SU-2026:22065-1
Vulnerability from csaf_suse - Published: 2026-06-10 08:12 - Updated: 2026-06-10 08:12Summary
Security update for elemental-toolkit
Severity
Important
Notes
Title of the patch: Security update for elemental-toolkit
Description of the patch: This update for elemental-toolkit fixes the following issue
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260277).
Changes for elemental-toolkit:
- Update to version 2.1.6:
* Bump golang.org/x/net to v0.55.0 (bsc#1267168)
* Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)
* Update orange flavor
* Install hugo from the OS repositories
* Bump actions/upload-artifact to v7
* Bump actions/cache to v5
* Bump golangci/golangci-lint-action to v9
* Bump github.com/spf13/cobra library
* Bump github.com/jaypipes/ghw library
* Bump github.com/bramvdbogaerde/go-scp library
* Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
* Bump github.com/ulikunitz/xz library
* Do not clean cache on PRs from forks
Patchnames: SUSE-SLE-Micro-6.0-749
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
64 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for elemental-toolkit",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for elemental-toolkit fixes the following issue\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260277).\n\nChanges for elemental-toolkit:\n\n- Update to version 2.1.6:\n * Bump golang.org/x/net to v0.55.0 (bsc#1267168)\n * Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)\n * Update orange flavor\n * Install hugo from the OS repositories\n * Bump actions/upload-artifact to v7\n * Bump actions/cache to v5\n * Bump golangci/golangci-lint-action to v9\n * Bump github.com/spf13/cobra library\n * Bump github.com/jaypipes/ghw library\n * Bump github.com/bramvdbogaerde/go-scp library\n * Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)\n * Bump github.com/ulikunitz/xz library\n * Do not clean cache on PRs from forks\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-749",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22065-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22065-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622065-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22065-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026725.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260277",
"url": "https://bugzilla.suse.com/1260277"
},
{
"category": "self",
"summary": "SUSE Bug 1266187",
"url": "https://bugzilla.suse.com/1266187"
},
{
"category": "self",
"summary": "SUSE Bug 1267168",
"url": "https://bugzilla.suse.com/1267168"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for elemental-toolkit",
"tracking": {
"current_release_date": "2026-06-10T08:12:23Z",
"generator": {
"date": "2026-06-10T08:12:23Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22065-1",
"initial_release_date": "2026-06-10T08:12:23Z",
"revision_history": [
{
"date": "2026-06-10T08:12:23Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "elemental-toolkit-2.1.6-1.1.aarch64",
"product": {
"name": "elemental-toolkit-2.1.6-1.1.aarch64",
"product_id": "elemental-toolkit-2.1.6-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "elemental-toolkit-2.1.6-1.1.x86_64",
"product": {
"name": "elemental-toolkit-2.1.6-1.1.x86_64",
"product_id": "elemental-toolkit-2.1.6-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-toolkit-2.1.6-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64"
},
"product_reference": "elemental-toolkit-2.1.6-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-toolkit-2.1.6-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
},
"product_reference": "elemental-toolkit-2.1.6-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.aarch64",
"SUSE Linux Micro 6.0:elemental-toolkit-2.1.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T08:12:23Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22074-1
Vulnerability from csaf_suse - Published: 2026-06-10 07:44 - Updated: 2026-06-10 07:44Summary
Security update for elemental-toolkit
Severity
Important
Notes
Title of the patch: Security update for elemental-toolkit
Description of the patch: This update for elemental-toolkit fixes the following issue
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260277).
Changes for elemental-toolkit:
- Update to v2.2.9:
* 0e33b2bc Bump golang.org/x/net to v0.55.0 (bsc#1267168)
* 4f5423b9 Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)
- Update to v2.2.8:
* 3f38ae3e Avoid pulling binaries with curl
* ef3f97a0 Bump golangci/golangci-lint-action to v9
* 34f9ed84 Bump github.com/spf13/cobra library
* dff54d9a Bump github.com/jaypipes/ghw library
* 7b7ba7ac github.com/bramvdbogaerde/go-scp libary
* ac19e71c Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)
* 55761782 Bump github.com/ulikunitz/xz library
* d04e480d Update headers to 2026
* bb7974f4 Switch from TW to Leap 16.0 for green flavor
Patchnames: SUSE-SLE-Micro-6.1-570
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
64 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for elemental-toolkit",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for elemental-toolkit fixes the following issue\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260277).\n\nChanges for elemental-toolkit:\n\n- Update to v2.2.9:\n * 0e33b2bc Bump golang.org/x/net to v0.55.0 (bsc#1267168)\n * 4f5423b9 Bump golang.org/x/crypto to v0.52.0 (bsc#1266187)\n- Update to v2.2.8:\n * 3f38ae3e Avoid pulling binaries with curl\n * ef3f97a0 Bump golangci/golangci-lint-action to v9\n * 34f9ed84 Bump github.com/spf13/cobra library\n * dff54d9a Bump github.com/jaypipes/ghw library\n * 7b7ba7ac github.com/bramvdbogaerde/go-scp libary\n * ac19e71c Bump google.golang.org/grpc library (bsc#1260277 CVE-2026-33186)\n * 55761782 Bump github.com/ulikunitz/xz library\n * d04e480d Update headers to 2026\n * bb7974f4 Switch from TW to Leap 16.0 for green flavor\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-570",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22074-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22074-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622074-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22074-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047276.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260277",
"url": "https://bugzilla.suse.com/1260277"
},
{
"category": "self",
"summary": "SUSE Bug 1266187",
"url": "https://bugzilla.suse.com/1266187"
},
{
"category": "self",
"summary": "SUSE Bug 1267168",
"url": "https://bugzilla.suse.com/1267168"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for elemental-toolkit",
"tracking": {
"current_release_date": "2026-06-10T07:44:30Z",
"generator": {
"date": "2026-06-10T07:44:30Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22074-1",
"initial_release_date": "2026-06-10T07:44:30Z",
"revision_history": [
{
"date": "2026-06-10T07:44:30Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"product": {
"name": "elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"product_id": "elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64",
"product": {
"name": "elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64",
"product_id": "elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64"
},
"product_reference": "elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
},
"product_reference": "elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:elemental-toolkit-2.2.9-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-10T07:44:30Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22157-1
Vulnerability from csaf_suse - Published: 2026-06-17 16:31 - Updated: 2026-06-17 16:31Summary
Security update for amazon-ssm-agent
Severity
Important
Notes
Title of the patch: Security update for amazon-ssm-agent
Description of the patch: This update for amazon-ssm-agent fixes the following issues
Update to version 3.3.4624.0:
- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
(bsc#1239342).
- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).
- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in
response to a key listing or signing request (bsc#1253611).
- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs
(bsc#1265474).
- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files
can lead to the consumption of corrupted files (bsc#1258095).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege esca (bsc#1266781).
- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during
smart-HTTP clone and fetch operations (bsc#1264952).
- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite
loops, panics or resource consumption (bsc#1267332).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266200).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266200).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266200).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266200).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266200).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).
Changes:
* Bump golang.org/x/crypto from v0.51.0 to v0.52.0
* Bump golang.org/x/net from v0.54.0 to v0.55.0
* Enforce directory boundary in BuildSafePath
* Fix visibility issue with Bottlerocket OS in document output
* Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this
also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)
* Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)
* Quit if sysprep failed and log its current state
* Remove attached legacy cloudwatch plugin packages
* Upgrade Go version to 1.25.10
* Use BuildSafePath wherever it is applicable
* Add OOM killer protection to systemd service files
* Apply more sanitation to file and registry inventory gatherers
* Bump go-git to v5.17.1
* Deprecate legacy cloudwatch plugin
* Preserve network error details in credential refresher SSM API failures
* Upgrade Go version to 1.25.9
* Add SSM Distributor support for Bottlerocket OS
* Implement flush credentials command in ssm-cli
* Log ec2messages access denied as debug instead of error to reduce log noise
* Make credential refresher refresh cache quickly in case of credential flush
* Make Greengrass component registration resilient with retry
* Add EnforceWorkspaceRootOwnership configuration to support disable
hardening of agent workspace
* Add reboot comment to Windows shutdown command for SSM Agent traceability
* Update privilege access check to verify ownership and permissions
of document state files
* Add read-only version check prior to install and uninstall
in case of occupied package manager locks
* Add ANSI processing for CloudWatch and S3 log
* Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3
to fix CVE-2026-1229
- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)
* Disable Go 1.25 container-aware GOMAXPROCS to prevent holding
cgroup file descriptors open
* Upgrade Go version to 1.25.8
* Document CommandWorkerBufferLimit config
* Include package update in Dockerfile
* Reduce CloudWatch event message length threshold
* Upgrade Go version to 1.25.7
* Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)
* Update greengrass version
* Update Golang version to 1.24.12
* Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net
from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0
(bsc#1253611, CVE-2025-47913)
* Categorize integration tests by adding new tags to split fast and slow ones
* Fix bug where IP field being empty string and causing UII API failure
* Allow Patch execution to persist across reboots not registered to SSM Agent
* Fix ENV_VAR interpolation to work correctly with parameter store value
* Implement immediate retries for failed reply messages to MGS for RunCommand documents
* Improve ssm-cli get-diagnostics command log output
* Support DomainJoin endpoint for EU sovereign cloud
* Support dualstack S3 endpoint for distributor packages
* Upgrade Go version to 1.24.11
* Add initial IPv6 support with UseDualStackEndpoint configuration option
* Fix CPU utilization issue for instances with thousands of network interfaces
* Add IMDS retry count to account for EC2 droplet refresh
* Fix duplicate uid error logging in MDS module
* Update aws:Domainjoin plugin logging from Log4Net to NLog
* Upgrade Go version to 1.24.7
* Update github.com/go-git/go-git/v5 to 5.15.0
* Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)
* Update golang.org/x/net to v0.39.0
* Update golang.org/x/sys to v0.32.0
* Add EU sovereign cloud S3 endpoint for DownloadContent plugin
* Add configurable credential rotation max backoff interval
* Migrate from twinj/uuid to google/uuid library
* Allow newer agent versions to be installed when deploying on Greengrass
* Harden function to remove non-admin run command documents in execution path
* Fix macOS credential refresher test issue due to missing Debugf from serialport skip file
* Enhance testability of custom certificate usage in debug SSM Agent builds
* Decouple serial port from startup and add credential refresher serialport logging
* Add GlobalEnhancedTelemetryEnabled config to README
* Add cloudwatch logs endpoint configuration to optional config for agent
* Update Greengrass component version
* Add file privilege check before processing document state file
* Storing AWS document interpolation ENV_VAR types as environment variables
* Throw explicit error when running local cli as non-priviledged user
* Harden telemetry dynamic config folder permissions
* Add configuration option for HandshakeTimeout
* Improve unit tests
* Add setup for emitting telemetry logs and metrics
* Add initial selection of error logs to emit to telemetry
* Simplify checkstyle and import organization in build scripts
* Update golang.org/x/net from v0.37.0 to v0.38.0
* Agent hibernation reason is logged to EC2 system logs
* Add metrics for the EC2Detector and IMDS EC2 status findings
* Change Linux DomainJoin plugin parameter KeepHostName to accept
both boolean and string
* Upgrade GoLang to version 1.23.8
* Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)
Patchnames: SUSE-SLES-16.0-943
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
4.4 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
4.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
77 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for amazon-ssm-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n of document state files\n * Add read-only version check prior to install and uninstall\n in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-943",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22157-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22157-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622157-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22157-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026930.html"
},
{
"category": "self",
"summary": "SUSE Bug 1238702",
"url": "https://bugzilla.suse.com/1238702"
},
{
"category": "self",
"summary": "SUSE Bug 1239342",
"url": "https://bugzilla.suse.com/1239342"
},
{
"category": "self",
"summary": "SUSE Bug 1253611",
"url": "https://bugzilla.suse.com/1253611"
},
{
"category": "self",
"summary": "SUSE Bug 1258095",
"url": "https://bugzilla.suse.com/1258095"
},
{
"category": "self",
"summary": "SUSE Bug 1264952",
"url": "https://bugzilla.suse.com/1264952"
},
{
"category": "self",
"summary": "SUSE Bug 1265474",
"url": "https://bugzilla.suse.com/1265474"
},
{
"category": "self",
"summary": "SUSE Bug 1266200",
"url": "https://bugzilla.suse.com/1266200"
},
{
"category": "self",
"summary": "SUSE Bug 1266781",
"url": "https://bugzilla.suse.com/1266781"
},
{
"category": "self",
"summary": "SUSE Bug 1267332",
"url": "https://bugzilla.suse.com/1267332"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22869 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22869/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22870 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22870/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47913 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47913/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-1229 page",
"url": "https://www.suse.com/security/cve/CVE-2026-1229/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25934 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25934/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-44740 page",
"url": "https://www.suse.com/security/cve/CVE-2026-44740/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for amazon-ssm-agent",
"tracking": {
"current_release_date": "2026-06-17T16:31:19Z",
"generator": {
"date": "2026-06-17T16:31:19Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22157-1",
"initial_release_date": "2026-06-17T16:31:19Z",
"revision_history": [
{
"date": "2026-06-17T16:31:19Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"product": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"product_id": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"product": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"product_id": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
},
"product_reference": "amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-22869",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22869"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22869",
"url": "https://www.suse.com/security/cve/CVE-2025-22869"
},
{
"category": "external",
"summary": "SUSE Bug 1239322 for CVE-2025-22869",
"url": "https://bugzilla.suse.com/1239322"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2025-22869"
},
{
"cve": "CVE-2025-22870",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22870"
}
],
"notes": [
{
"category": "general",
"text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22870",
"url": "https://www.suse.com/security/cve/CVE-2025-22870"
},
{
"category": "external",
"summary": "SUSE Bug 1238572 for CVE-2025-22870",
"url": "https://bugzilla.suse.com/1238572"
},
{
"category": "external",
"summary": "SUSE Bug 1238611 for CVE-2025-22870",
"url": "https://bugzilla.suse.com/1238611"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "moderate"
}
],
"title": "CVE-2025-22870"
},
{
"cve": "CVE-2025-47913",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47913"
}
],
"notes": [
{
"category": "general",
"text": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47913",
"url": "https://www.suse.com/security/cve/CVE-2025-47913"
},
{
"category": "external",
"summary": "SUSE Bug 1253506 for CVE-2025-47913",
"url": "https://bugzilla.suse.com/1253506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2025-47913"
},
{
"cve": "CVE-2026-1229",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-1229"
}
],
"notes": [
{
"category": "general",
"text": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-1229",
"url": "https://www.suse.com/security/cve/CVE-2026-1229"
},
{
"category": "external",
"summary": "SUSE Bug 1265416 for CVE-2026-1229",
"url": "https://bugzilla.suse.com/1265416"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-1229"
},
{
"cve": "CVE-2026-25934",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25934"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25934",
"url": "https://www.suse.com/security/cve/CVE-2026-25934"
},
{
"category": "external",
"summary": "SUSE Bug 1258093 for CVE-2026-25934",
"url": "https://bugzilla.suse.com/1258093"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "moderate"
}
],
"title": "CVE-2026-25934"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-41506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41506"
}
],
"notes": [
{
"category": "general",
"text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41506",
"url": "https://www.suse.com/security/cve/CVE-2026-41506"
},
{
"category": "external",
"summary": "SUSE Bug 1264854 for CVE-2026-41506",
"url": "https://bugzilla.suse.com/1264854"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "moderate"
}
],
"title": "CVE-2026-41506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-44740",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-44740"
}
],
"notes": [
{
"category": "general",
"text": "Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-44740",
"url": "https://www.suse.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "SUSE Bug 1267264 for CVE-2026-44740",
"url": "https://bugzilla.suse.com/1267264"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-44740"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:amazon-ssm-agent-3.3.4624.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-17T16:31:19Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22159-1
Vulnerability from csaf_suse - Published: 2026-06-18 14:30 - Updated: 2026-06-18 14:30Summary
Security update for distribution
Severity
Important
Notes
Title of the patch: Security update for distribution
Description of the patch: This update for distribution fixes the following issues
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265788).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266629).
- CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266049).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266049).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266049).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266049).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266049).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).
Changes:
* Bounds-check the file basename in PurgeUploads Walk callback
* Add S3 Express One Zone support to the S3 storage driver
* Fix tag list endpoint in proxy mode
* Clamp oversized `n` query parameter in proxy mode instead of
returning 400
* See the full changelog below for the full list of changes.
* internal/client/auth/challenge: cleanups and minor refactor
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
from 0.18.0 to 0.19.0 in the go_modules group across 1
directory
* build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl
ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules
group across 1 directory
* build(deps): bump github/codeql-action from 4.34.1 to 4.35.1
* chore(build): Bump go version to latest
* refactor: use slices.Backward to simplify the code
* fix(proxy): fix tag list endpoint in proxy mode
* Update docker-compose structure in deploying.md
* build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
* build(deps): bump actions/upload-pages-artifact from 4.0.0 to
5.0.0
* build(deps): bump docker/login-action from 4.0.0 to 4.1.0
* build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
* fix(proxy): clamp oversized n query param instead of
* feat(s3): add express zone one support to S3 driver
* fix(storage): bounds-check the file basename in PurgeUploads
Walk callback
* chore(release): prepare for v3.1.1 release
Patchnames: SUSE-SLES-16.0-949
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
57 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for distribution",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for distribution fixes the following issues\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265788).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266629).\n- CVE-2026-41888: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265429).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266049).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266049).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266049).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266049).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266049).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266049).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266049).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266049).\n\nChanges:\n\n * Bounds-check the file basename in PurgeUploads Walk callback\n * Add S3 Express One Zone support to the S3 storage driver\n * Fix tag list endpoint in proxy mode\n * Clamp oversized `n` query parameter in proxy mode instead of\n returning 400\n * See the full changelog below for the full list of changes.\n * internal/client/auth/challenge: cleanups and minor refactor\n * build(deps): bump\n go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp\n from 0.18.0 to 0.19.0 in the go_modules group across 1\n directory\n * build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otl\n ptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules\n group across 1 directory\n * build(deps): bump github/codeql-action from 4.34.1 to 4.35.1\n * chore(build): Bump go version to latest\n * refactor: use slices.Backward to simplify the code\n * fix(proxy): fix tag list endpoint in proxy mode\n * Update docker-compose structure in deploying.md\n * build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1\n * build(deps): bump actions/upload-pages-artifact from 4.0.0 to\n 5.0.0\n * build(deps): bump docker/login-action from 4.0.0 to 4.1.0\n * build(deps): bump docker/bake-action from 7.0.0 to 7.1.0\n * fix(proxy): clamp oversized n query param instead of\n * feat(s3): add express zone one support to S3 driver\n * fix(storage): bounds-check the file basename in PurgeUploads\n Walk callback\n * chore(release): prepare for v3.1.1 release\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-949",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22159-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22159-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622159-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22159-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026928.html"
},
{
"category": "self",
"summary": "SUSE Bug 1265429",
"url": "https://bugzilla.suse.com/1265429"
},
{
"category": "self",
"summary": "SUSE Bug 1265788",
"url": "https://bugzilla.suse.com/1265788"
},
{
"category": "self",
"summary": "SUSE Bug 1266049",
"url": "https://bugzilla.suse.com/1266049"
},
{
"category": "self",
"summary": "SUSE Bug 1266629",
"url": "https://bugzilla.suse.com/1266629"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41888 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41888/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for distribution",
"tracking": {
"current_release_date": "2026-06-18T14:30:18Z",
"generator": {
"date": "2026-06-18T14:30:18Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22159-1",
"initial_release_date": "2026-06-18T14:30:18Z",
"revision_history": [
{
"date": "2026-06-18T14:30:18Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.aarch64",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.aarch64",
"product_id": "distribution-registry-3.1.1-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"product_id": "distribution-registry-3.1.1-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.s390x",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.s390x",
"product_id": "distribution-registry-3.1.1-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "distribution-registry-3.1.1-160000.1.1.x86_64",
"product": {
"name": "distribution-registry-3.1.1-160000.1.1.x86_64",
"product_id": "distribution-registry-3.1.1-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "distribution-registry-3.1.1-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
},
"product_reference": "distribution-registry-3.1.1-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-41888",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41888"
}
],
"notes": [
{
"category": "general",
"text": "Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/\u003cname\u003e/manifests/\u003ctag\u003e endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41888",
"url": "https://www.suse.com/security/cve/CVE-2026-41888"
},
{
"category": "external",
"summary": "SUSE Bug 1265422 for CVE-2026-41888",
"url": "https://bugzilla.suse.com/1265422"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "moderate"
}
],
"title": "CVE-2026-41888"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:distribution-registry-3.1.1-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:distribution-registry-3.1.1-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-18T14:30:18Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22193-1
Vulnerability from csaf_suse - Published: 2026-06-20 06:52 - Updated: 2026-06-20 06:52Summary
Security update for mcphost
Severity
Important
Notes
Title of the patch: Security update for mcphost
Description of the patch: This update for mcphost fixes the following issues
- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues
when parsing HTML files (bsc#1267109).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265730).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266572).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266145).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266145).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).
Patchnames: SUSE-SLES-16.0-985
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
69 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mcphost",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mcphost fixes the following issues\n\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n when parsing HTML files (bsc#1267109).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265730).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266572).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266145).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266145).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-985",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22193-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22193-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622193-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22193-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047515.html"
},
{
"category": "self",
"summary": "SUSE Bug 1265730",
"url": "https://bugzilla.suse.com/1265730"
},
{
"category": "self",
"summary": "SUSE Bug 1266145",
"url": "https://bugzilla.suse.com/1266145"
},
{
"category": "self",
"summary": "SUSE Bug 1266572",
"url": "https://bugzilla.suse.com/1266572"
},
{
"category": "self",
"summary": "SUSE Bug 1267109",
"url": "https://bugzilla.suse.com/1267109"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for mcphost",
"tracking": {
"current_release_date": "2026-06-20T06:52:25Z",
"generator": {
"date": "2026-06-20T06:52:25Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22193-1",
"initial_release_date": "2026-06-20T06:52:25Z",
"revision_history": [
{
"date": "2026-06-20T06:52:25Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product_id": "mcphost-0.34.0-160000.2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product_id": "mcphost-0.34.0-160000.2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product": {
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product_id": "mcphost-0.34.0-160000.2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product_id": "mcphost-0.34.0-160000.2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le"
},
"product_reference": "mcphost-0.34.0-160000.2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x"
},
"product_reference": "mcphost-0.34.0-160000.2.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le"
},
"product_reference": "mcphost-0.34.0-160000.2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x"
},
"product_reference": "mcphost-0.34.0-160000.2.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server 16.0:mcphost-0.34.0-160000.2.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22226-1
Vulnerability from csaf_suse - Published: 2026-06-20 06:52 - Updated: 2026-06-20 06:52Summary
Security update for mcphost
Severity
Important
Notes
Title of the patch: Security update for mcphost
Description of the patch: This update for mcphost fixes the following issues
- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues
when parsing HTML files (bsc#1267109).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265730).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266572).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266145).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266145).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266145).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).
Patchnames: SUSE-SL-Micro-6.2-985
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
69 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mcphost",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mcphost fixes the following issues\n\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n when parsing HTML files (bsc#1267109).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265730).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266572).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266145).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266145).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266145).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SL-Micro-6.2-985",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22226-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22226-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622226-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22226-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047482.html"
},
{
"category": "self",
"summary": "SUSE Bug 1265730",
"url": "https://bugzilla.suse.com/1265730"
},
{
"category": "self",
"summary": "SUSE Bug 1266145",
"url": "https://bugzilla.suse.com/1266145"
},
{
"category": "self",
"summary": "SUSE Bug 1266572",
"url": "https://bugzilla.suse.com/1266572"
},
{
"category": "self",
"summary": "SUSE Bug 1267109",
"url": "https://bugzilla.suse.com/1267109"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for mcphost",
"tracking": {
"current_release_date": "2026-06-20T06:52:25Z",
"generator": {
"date": "2026-06-20T06:52:25Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22226-1",
"initial_release_date": "2026-06-20T06:52:25Z",
"revision_history": [
{
"date": "2026-06-20T06:52:25Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.aarch64",
"product_id": "mcphost-0.34.0-160000.2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le",
"product_id": "mcphost-0.34.0-160000.2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product": {
"name": "mcphost-0.34.0-160000.2.1.s390x",
"product_id": "mcphost-0.34.0-160000.2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product": {
"name": "mcphost-0.34.0-160000.2.1.x86_64",
"product_id": "mcphost-0.34.0-160000.2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.2",
"product": {
"name": "SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le"
},
"product_reference": "mcphost-0.34.0-160000.2.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x"
},
"product_reference": "mcphost-0.34.0-160000.2.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mcphost-0.34.0-160000.2.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
},
"product_reference": "mcphost-0.34.0-160000.2.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.aarch64",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.ppc64le",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.s390x",
"SUSE Linux Micro 6.2:mcphost-0.34.0-160000.2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-20T06:52:25Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22242-1
Vulnerability from csaf_suse - Published: 2026-06-22 09:09 - Updated: 2026-06-22 09:09Summary
Security update for google-osconfig-agent
Severity
Important
Notes
Title of the patch: Security update for google-osconfig-agent
Description of the patch: This update for google-osconfig-agent fixes the following issues
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents
(bsc#1251453).
- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially
crafted input (bsc#1251704).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260264).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265762).
- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of
service (bsc#1262926).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266171).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266171).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during
smart-HTTP clone and fetch operations (bsc#1264923).
Changes for google-osconfig-agent:
- Update to version 20260615.01
* Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
- from version 20260615.00
* Add unit tests for ospatch_apt_upgrade.go (#938)
- Update to version 20260611.00
* Add unit tests for policies/policies.go PART 5 (#998)
- from version 20260610.00
* Add unit tests for policies/policies.go PART 4 (#997)
- from version 20260609.02
* squash commits (#936)
- from version 20260609.01
* Add unit tests for policies/policies.go PART 3 (#996)
- from version 20260609.00
* Add unit tests for policies/policies.go PART 2 (#991)
- from version 20260602.01
* Align format of dates and timestamp collected across Windows packages (#973)
- from version 20260602.00
* Add unit tests for config/config,go (#979)
- from version 20260528.00
* Bump github.com/containerd/containerd (#990)
- from version 20260521.00
* Cover agentconfig functionality by unit tests (#925)
- from version 20260520.04
* Add unit tests for policies/googet.go (#961)
* Bump github.com/go-git/go-git/v5 (#987)
- from version 20260520.02
* Add unit tests for policies/yum.go (#952)
* Add unit tests for policies/apt.go PART 3 (#951)
- from version 20260520.00
* Add unit tests for policies/zypper.go (#953)
- from version 20260519.00
* Add unit tests for policies/policies.go PART 1 (#949)
- from version 20260513.01
* Bump github.com/go-git/go-git/v5 (#981), this also updates
golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
- from version 20260513.00
* upgrade a few packages (#980)
- from version 20260512.02
* Add/improve unit tests for agentendpoint/exec_task.go (#933)
- from version 20260512.01
* Cover google_update.go by unit tests (#941)
- from version 20260512.00
* Change zone for arm64 builds because of stockout (#978)
- Update to version 20260511.00
* switch to t2a-standard-2 on ARM package build (#977)
- from version 20260505.03
* Cover zypper_patch by unit tests (#958)
- from version 20260505.02
* Remove unused functions DisableAutoUpdates (#970)
- from version 20260505.01
* Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)
- from version 20260505.00
* Upgrade a few dependencies across the repo (#968)
+ github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506)
+ github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986)
+ github.com/go-viper/mapstructure/v2 2.3.0->2.4.0
+ go.opentelemetry.io/otel 1.40.0->1.41.0
+ go.opentelemetry.io/otel/sdk 1.39.0->1.43.0
- from version 20260504.01
* bump github.com/docker/cli to 29.2.0 (#962)
- from version 20260504.00
* Bump github.com/opencontainers/selinux (#960)
- Update to version 20260428.00
* Add/improve unit tests for agentendpoint/agentendpoint.go (#930)
- from version 20260427.03
* Cover config/file.go by unit tests (#935)
- from version 20260422.01
* Cover patch_linux.go by unit tests (#932)
- from version 20260422.00
* upgrade grpc package in main package and e2e tests (#959)
(bsc#1260264, CVE-2026-33186)
- from version 20260417.04
* Bump OSV-Scalibr version to v0.4.3 (#956)
- from version 20260417.03
* Add unit tests for updates_linux.go (#937)
- from version 20260417.02
* Add zone to CreateDisk step (#955)
- from version 20260417.01
* Change disk type for deb11 (#954)
- from version 20260417.00
* Add unit tests for policies/apt.go PART 1 (#950)
- from version 20260410.02
* Add unit tests for packages/pty_linux.go (#943)
- from version 20260410.01
* fix disk type for arm workflows (#948)
- from version 20260410.00
* Change machine type for arm based workflows (#946)
- Update to version 20260330.00
* bump timeouts for all workflows (#940)
- from version 20260326.00
* Cover exec_resource.go by unit tests (#934)
- from version 20260318.00
* Integrate OSConfig agent with ReportVmInventory (#923)
- from version 20260313.02
* remove cacheonly flag from yum upgrade (#924)
- from version 20260313.01
* conditions python version override (#927)
- from version 20260313.00
* Fix presubmits by explicitly set python version for rpm based systems (#926)
- from version 20260311.00
* Bump osconfig version (#922)
- from version 20260309.02
* Extend OSV scalibr extractor (#921)
- from version 20260309.01
* upgrade golang.org/x/crypto and it's transitive deps (#918)
- from version 20260309.00
* Add purl to pkg info (#920)
- from version 20260306.00
* Add 'Type' field to PkgInfo (#919)
- from version 20260303.01
* Upgrade go.opentelemetry.io/otel/sdk (#913)
- from version 20260303.00
* Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)
- from version 20260302.00
* Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)
- from version 20260126.00
* Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)
* Bump github.com/sirupsen/logrus (#894)
- Update to version 20260119.00
* Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)
- Update to version 20251230.00
* chore: Migrate gsutil usage to gcloud storage (#904)
- from version 20251223.00
* fix e2e tests for report inventory (#903)
- from version 20251222.01
* Revert "Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)" (#902)
- from version 20251222.00
* Bump golang to the new version (#900)
- from version 20251218.00
* add new CODEOWNERS (#901)
- from version 20251217.00
* Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)
- Bump the golang compiler version to 1.24.5
- Update to version 20251202.00
* Revert "Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)" (#893)
- Update to version 20251201.00
* Revert "Bump github.com/containerd/containerd (#890)" (#892)
- Update to version 20251126.00
* Bump github.com/containerd/containerd (#890)
* Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)
- Update to version 20251028.00
* Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)
* Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)
- from version 20251023.02
* Create multiple_os.yaml (#883)
- from version 20251023.00
* Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)
* Add test runner for e2e tests (#876)
- Update to version 20250925.00
* Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)
* Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)
* Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)
* Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)
- Update to version 20250902.01
* Bump github.com/googleapis/enterprise-certificate-proxy (#829)
- from version 20250902.00
* update github.com/go-jose/go-jose/v4 (#869)
* Upgrade scalibr and other deps (#866)
- from version 20250901.00
* Fix possibility of path traversal for zip and tar archival (#868)
- from version 20250825.00
* set CODEOWNERS file as required by org (#863)
- from version 20250819.00
* Fix/rhel10 build centos image (#860)
- from version 20250814.00
* Fix/rhel10 build image (#859)
- from version 20250813.00
* Fix: Add RHEL 10 support to RPM startup script (#858)
- from version 20250811.00
* Remove old/sles-15-sp4-sap as image is deprecated (#857)
- Update to version 20250806.00
* Fixed JSON identifier for the universe domain (#855)
- from version 20250729.00
* Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)
- from version 20250725.02
* Update utils.go (#854)
* Upgrade golang.org/x/oauth2 package to the latest. (#853)
* Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)
- from version 20250725.01
* Bump golang.org/x/oauth2 (#848)
* Port fix for debian 11 to goo package manager. (#852)
- from version 20250725.00
* Update Golang version in common.sh and skip backports
repo for debian 11 (#850)
- from version 20250723.01
* Add workflows to build package for el10 (#849)
- from version 20250721.00
* Make OS Config agent TPC aware (#846)
- from version 20250718.00
* Create workflows for new Debian 13. (#847)
- Update to version 20250703.00
* Fix sles images (#844)
- from version 20250702.00
* Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)
- from version 20250701.00
* Bump the go_modules group across 1 directory with 2 updates (#840)
- Update to version 20250606.00
* Change base docker images Google's official base images. (#838)
- Update to version 20250523.01
* Add a simple no-op OS policy for user testing (#837)
- from version 20250523.00
* Introduce scalibr inventory extractor for dpkg/rpm/cos
os/filesystem extractors (linux) (#834)
* Trace GetInstalledPackages memory levels (#835)
- from version 20250520.00
- Update to version 20250513.00
* Fix rpm extractor, handle (none) value correctly. (#833)
- from version 20250512.01
* Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)
- from version 20250512.00
* Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)
- from version 20250508.01
* cosmetic refactoring to osinfo package (#826)
- from version 20250508.00
* Refactor /inventory with dependency injection (#825)
* Add debian, ubuntu (InstalledDebPackages) snapshots (#821)
* cover packages_linux.go file with tests (#824)
* Add debian (10,11,12) GetPackageUpdates output snapshots (#822)
- from version 20250507.00
* Add InstalledRPMPackages snapshot tests (#823)
- from version 20250506.02
* Yum tests: simplify initialization of exit errors (#820)
- from version 20250506.01
* Improve test coverage for gem package manager (#818)
- from version 20250506.00
* after go/x/crypto update 0.32.0 -> 0.37.0 (#817)
- from version 20250505.01
* Improve packages package coverage (#814)
* Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)
- from version 20250505.00
* Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)
- from version 20250430.00
* Snapshot YumUpdates (GetPackageUpdates) output (#813)
- from version 20250428.00
* Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output
for sles 12, 15 testdata (#812)
- from version 20250423.00
* Introduce MatchSnapshot large test results matcher function, snapshot
apt-deb GetPackageUpdates (#811)
- from version 20250416.02
* defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)
* Add output of some packagemanagers to the testdata (#808)
- from version 20250416.01
* Refactor OS Info package (#809)
- from version 20250416.00
* Report RPM inventory as YUM instead of empty SoftwarePackage
when neither Zypper nor YUM are installed. (#805)
- from version 20250414.00
* Update hash computation algorithm (#799)
- Update to version 20250320.00
* Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)
- from version 20250318.00
* Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)
- from version 20250317.02
* Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)
* Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)
- from version 20250317.01
* Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)
- from version 20250317.00
* Add tests for retryutil package. (#795)
- from version 20250306.00
* Update OWNERS (#794)
- from version 20250206.01
* Use separate counters for pre- and post-patch reboots. (#788)
- from version 20250206.00
* Update owners (#789)
- from version 20250203.00
* Fix the vet errors for contants in logging (#786)
- from version 20250122.00
* change available package check (#783)
- from version 20250121.00
* Fix Inventory reporting e2e tests. (#782)
- from version 20250120.00
* fix e2e tests (#781)
- Add -buildmode=pie to go build command line (bsc#1239948)
- from version 20240501.00 (bsc#1236533, CVE-2023-45288)
Patchnames: SUSE-SLE-Micro-6.0-764
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
89 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-osconfig-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-osconfig-agent fixes the following issues\n\n- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n (bsc#1251453).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n crafted input (bsc#1251704).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260264).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265762).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n service (bsc#1262926).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266603).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent \n (bsc#1266171).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266171).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n smart-HTTP clone and fetch operations (bsc#1264923).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260615.01\n * Upgrade golang.org/x/crypto \u0026 golang.org/x/net (#1006)\n- from version 20260615.00\n * Add unit tests for ospatch_apt_upgrade.go (#938)\n- Update to version 20260611.00\n * Add unit tests for policies/policies.go PART 5 (#998)\n- from version 20260610.00\n * Add unit tests for policies/policies.go PART 4 (#997)\n- from version 20260609.02\n * squash commits (#936)\n- from version 20260609.01\n * Add unit tests for policies/policies.go PART 3 (#996)\n- from version 20260609.00\n * Add unit tests for policies/policies.go PART 2 (#991)\n- from version 20260602.01\n * Align format of dates and timestamp collected across Windows packages (#973)\n- from version 20260602.00\n * Add unit tests for config/config,go (#979)\n- from version 20260528.00\n * Bump github.com/containerd/containerd (#990)\n- from version 20260521.00\n * Cover agentconfig functionality by unit tests (#925)\n- from version 20260520.04\n * Add unit tests for policies/googet.go (#961)\n * Bump github.com/go-git/go-git/v5 (#987)\n- from version 20260520.02\n * Add unit tests for policies/yum.go (#952)\n * Add unit tests for policies/apt.go PART 3 (#951)\n- from version 20260520.00\n * Add unit tests for policies/zypper.go (#953)\n- from version 20260519.00\n * Add unit tests for policies/policies.go PART 1 (#949)\n- from version 20260513.01\n * Bump github.com/go-git/go-git/v5 (#981), this also updates\n golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)\n- from version 20260513.00\n * upgrade a few packages (#980)\n- from version 20260512.02\n * Add/improve unit tests for agentendpoint/exec_task.go (#933)\n- from version 20260512.01\n * Cover google_update.go by unit tests (#941)\n- from version 20260512.00\n * Change zone for arm64 builds because of stockout (#978)\n- Update to version 20260511.00\n * switch to t2a-standard-2 on ARM package build (#977)\n- from version 20260505.03\n * Cover zypper_patch by unit tests (#958)\n- from version 20260505.02\n * Remove unused functions DisableAutoUpdates (#970)\n- from version 20260505.01\n * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)\n- from version 20260505.00\n * Upgrade a few dependencies across the repo (#968)\n + github.com/go-git/go-git/v5 5.16.2-\u003e5.18.0 (bsc#1264923, CVE-2026-41506)\n + github.com/go-jose/go-jose/v4 4.1.3-\u003e4.1.4 (bsc#1262926, CVE-2026-34986)\n + github.com/go-viper/mapstructure/v2 2.3.0-\u003e2.4.0\n + go.opentelemetry.io/otel 1.40.0-\u003e1.41.0\n + go.opentelemetry.io/otel/sdk 1.39.0-\u003e1.43.0\n- from version 20260504.01\n * bump github.com/docker/cli to 29.2.0 (#962)\n- from version 20260504.00\n * Bump github.com/opencontainers/selinux (#960)\n- Update to version 20260428.00\n * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)\n- from version 20260427.03\n * Cover config/file.go by unit tests (#935)\n- from version 20260422.01\n * Cover patch_linux.go by unit tests (#932)\n- from version 20260422.00\n * upgrade grpc package in main package and e2e tests (#959)\n (bsc#1260264, CVE-2026-33186)\n- from version 20260417.04\n * Bump OSV-Scalibr version to v0.4.3 (#956)\n- from version 20260417.03\n * Add unit tests for updates_linux.go (#937)\n- from version 20260417.02\n * Add zone to CreateDisk step (#955)\n- from version 20260417.01\n * Change disk type for deb11 (#954)\n- from version 20260417.00\n * Add unit tests for policies/apt.go PART 1 (#950)\n- from version 20260410.02\n * Add unit tests for packages/pty_linux.go (#943)\n- from version 20260410.01\n * fix disk type for arm workflows (#948)\n- from version 20260410.00\n * Change machine type for arm based workflows (#946)\n- Update to version 20260330.00\n * bump timeouts for all workflows (#940)\n- from version 20260326.00\n * Cover exec_resource.go by unit tests (#934)\n- from version 20260318.00\n * Integrate OSConfig agent with ReportVmInventory (#923)\n- from version 20260313.02\n * remove cacheonly flag from yum upgrade (#924)\n- from version 20260313.01\n * conditions python version override (#927)\n- from version 20260313.00\n * Fix presubmits by explicitly set python version for rpm based systems (#926)\n- from version 20260311.00\n * Bump osconfig version (#922)\n- from version 20260309.02\n * Extend OSV scalibr extractor (#921)\n- from version 20260309.01\n * upgrade golang.org/x/crypto and it\u0027s transitive deps (#918)\n- from version 20260309.00\n * Add purl to pkg info (#920)\n- from version 20260306.00\n * Add \u0027Type\u0027 field to PkgInfo (#919)\n- from version 20260303.01\n * Upgrade go.opentelemetry.io/otel/sdk (#913)\n- from version 20260303.00\n * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)\n- from version 20260302.00\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)\n- from version 20260126.00\n * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)\n * Bump github.com/sirupsen/logrus (#894)\n- Update to version 20260119.00\n * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)\n- Update to version 20251230.00\n * chore: Migrate gsutil usage to gcloud storage (#904)\n- from version 20251223.00\n * fix e2e tests for report inventory (#903)\n- from version 20251222.01\n * Revert \"Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\" (#902)\n- from version 20251222.00\n * Bump golang to the new version (#900)\n- from version 20251218.00\n * add new CODEOWNERS (#901)\n- from version 20251217.00\n * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\n- Bump the golang compiler version to 1.24.5\n- Update to version 20251202.00\n * Revert \"Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\" (#893)\n- Update to version 20251201.00\n * Revert \"Bump github.com/containerd/containerd (#890)\" (#892)\n- Update to version 20251126.00\n * Bump github.com/containerd/containerd (#890)\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\n- Update to version 20251028.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)\n * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)\n- from version 20251023.02\n * Create multiple_os.yaml (#883)\n- from version 20251023.00\n * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)\n * Add test runner for e2e tests (#876)\n- Update to version 20250925.00\n * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)\n * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)\n * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)\n * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)\n- Update to version 20250902.01\n * Bump github.com/googleapis/enterprise-certificate-proxy (#829)\n- from version 20250902.00\n * update github.com/go-jose/go-jose/v4 (#869)\n * Upgrade scalibr and other deps (#866)\n- from version 20250901.00\n * Fix possibility of path traversal for zip and tar archival (#868)\n- from version 20250825.00\n * set CODEOWNERS file as required by org (#863)\n- from version 20250819.00\n * Fix/rhel10 build centos image (#860)\n- from version 20250814.00\n * Fix/rhel10 build image (#859)\n- from version 20250813.00\n * Fix: Add RHEL 10 support to RPM startup script (#858)\n- from version 20250811.00\n * Remove old/sles-15-sp4-sap as image is deprecated (#857)\n- Update to version 20250806.00\n * Fixed JSON identifier for the universe domain (#855)\n- from version 20250729.00\n * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)\n- from version 20250725.02\n * Update utils.go (#854)\n * Upgrade golang.org/x/oauth2 package to the latest. (#853)\n * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)\n- from version 20250725.01\n * Bump golang.org/x/oauth2 (#848)\n * Port fix for debian 11 to goo package manager. (#852)\n- from version 20250725.00\n * Update Golang version in common.sh and skip backports\n repo for debian 11 (#850)\n- from version 20250723.01\n * Add workflows to build package for el10 (#849)\n- from version 20250721.00\n * Make OS Config agent TPC aware (#846)\n- from version 20250718.00\n * Create workflows for new Debian 13. (#847)\n- Update to version 20250703.00\n * Fix sles images (#844)\n- from version 20250702.00\n * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)\n- from version 20250701.00\n * Bump the go_modules group across 1 directory with 2 updates (#840)\n- Update to version 20250606.00\n * Change base docker images Google\u0027s official base images. (#838)\n- Update to version 20250523.01\n * Add a simple no-op OS policy for user testing (#837)\n- from version 20250523.00\n * Introduce scalibr inventory extractor for dpkg/rpm/cos\n os/filesystem extractors (linux) (#834)\n * Trace GetInstalledPackages memory levels (#835)\n- from version 20250520.00\n- Update to version 20250513.00\n * Fix rpm extractor, handle (none) value correctly. (#833)\n- from version 20250512.01\n * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)\n- from version 20250512.00\n * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)\n- from version 20250508.01\n * cosmetic refactoring to osinfo package (#826)\n- from version 20250508.00\n * Refactor /inventory with dependency injection (#825)\n * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)\n * cover packages_linux.go file with tests (#824)\n * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)\n- from version 20250507.00\n * Add InstalledRPMPackages snapshot tests (#823)\n- from version 20250506.02\n * Yum tests: simplify initialization of exit errors (#820)\n- from version 20250506.01\n * Improve test coverage for gem package manager (#818)\n- from version 20250506.00\n * after go/x/crypto update 0.32.0 -\u003e 0.37.0 (#817)\n- from version 20250505.01\n * Improve packages package coverage (#814)\n * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)\n- from version 20250505.00\n * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)\n- from version 20250430.00\n * Snapshot YumUpdates (GetPackageUpdates) output (#813)\n- from version 20250428.00\n * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output\n for sles 12, 15 testdata (#812)\n- from version 20250423.00\n * Introduce MatchSnapshot large test results matcher function, snapshot\n apt-deb GetPackageUpdates (#811)\n- from version 20250416.02\n * defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)\n * Add output of some packagemanagers to the testdata (#808)\n- from version 20250416.01\n * Refactor OS Info package (#809)\n- from version 20250416.00\n * Report RPM inventory as YUM instead of empty SoftwarePackage\n when neither Zypper nor YUM are installed. (#805)\n- from version 20250414.00\n * Update hash computation algorithm (#799)\n- Update to version 20250320.00\n * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)\n- from version 20250318.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)\n- from version 20250317.02\n * Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)\n * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)\n- from version 20250317.01\n * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)\n- from version 20250317.00\n * Add tests for retryutil package. (#795)\n- from version 20250306.00\n * Update OWNERS (#794)\n- from version 20250206.01\n * Use separate counters for pre- and post-patch reboots. (#788)\n- from version 20250206.00\n * Update owners (#789)\n- from version 20250203.00\n * Fix the vet errors for contants in logging (#786)\n- from version 20250122.00\n * change available package check (#783)\n- from version 20250121.00\n * Fix Inventory reporting e2e tests. (#782)\n- from version 20250120.00\n * fix e2e tests (#781)\n- Add -buildmode=pie to go build command line (bsc#1239948)\n- from version 20240501.00 (bsc#1236533, CVE-2023-45288)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-764",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22242-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22242-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622242-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22242-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047622.html"
},
{
"category": "self",
"summary": "SUSE Bug 1210938",
"url": "https://bugzilla.suse.com/1210938"
},
{
"category": "self",
"summary": "SUSE Bug 1236533",
"url": "https://bugzilla.suse.com/1236533"
},
{
"category": "self",
"summary": "SUSE Bug 1239948",
"url": "https://bugzilla.suse.com/1239948"
},
{
"category": "self",
"summary": "SUSE Bug 1244304",
"url": "https://bugzilla.suse.com/1244304"
},
{
"category": "self",
"summary": "SUSE Bug 1244503",
"url": "https://bugzilla.suse.com/1244503"
},
{
"category": "self",
"summary": "SUSE Bug 1251453",
"url": "https://bugzilla.suse.com/1251453"
},
{
"category": "self",
"summary": "SUSE Bug 1251704",
"url": "https://bugzilla.suse.com/1251704"
},
{
"category": "self",
"summary": "SUSE Bug 1260264",
"url": "https://bugzilla.suse.com/1260264"
},
{
"category": "self",
"summary": "SUSE Bug 1262926",
"url": "https://bugzilla.suse.com/1262926"
},
{
"category": "self",
"summary": "SUSE Bug 1264923",
"url": "https://bugzilla.suse.com/1264923"
},
{
"category": "self",
"summary": "SUSE Bug 1265762",
"url": "https://bugzilla.suse.com/1265762"
},
{
"category": "self",
"summary": "SUSE Bug 1266171",
"url": "https://bugzilla.suse.com/1266171"
},
{
"category": "self",
"summary": "SUSE Bug 1266603",
"url": "https://bugzilla.suse.com/1266603"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-45288 page",
"url": "https://www.suse.com/security/cve/CVE-2023-45288/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22868 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22868/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-34986 page",
"url": "https://www.suse.com/security/cve/CVE-2026-34986/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for google-osconfig-agent",
"tracking": {
"current_release_date": "2026-06-22T09:09:04Z",
"generator": {
"date": "2026-06-22T09:09:04Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22242-1",
"initial_release_date": "2026-06-22T09:09:04Z",
"revision_history": [
{
"date": "2026-06-22T09:09:04Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.1.aarch64",
"product": {
"name": "google-osconfig-agent-20260615.01-1.1.aarch64",
"product_id": "google-osconfig-agent-20260615.01-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.1.s390x",
"product": {
"name": "google-osconfig-agent-20260615.01-1.1.s390x",
"product_id": "google-osconfig-agent-20260615.01-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.1.x86_64",
"product": {
"name": "google-osconfig-agent-20260615.01-1.1.x86_64",
"product_id": "google-osconfig-agent-20260615.01-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-45288",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-45288"
}
],
"notes": [
{
"category": "general",
"text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-45288",
"url": "https://www.suse.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "SUSE Bug 1221400 for CVE-2023-45288",
"url": "https://bugzilla.suse.com/1221400"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2023-45288"
},
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
},
{
"cve": "CVE-2025-22868",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22868"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22868",
"url": "https://www.suse.com/security/cve/CVE-2025-22868"
},
{
"category": "external",
"summary": "SUSE Bug 1239185 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239185"
},
{
"category": "external",
"summary": "SUSE Bug 1239186 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239186"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2025-22868"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
},
{
"category": "external",
"summary": "SUSE Bug 1268676 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1268676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-34986",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-34986"
}
],
"notes": [
{
"category": "general",
"text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-34986",
"url": "https://www.suse.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "SUSE Bug 1262805 for CVE-2026-34986",
"url": "https://bugzilla.suse.com/1262805"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-34986"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-41506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41506"
}
],
"notes": [
{
"category": "general",
"text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41506",
"url": "https://www.suse.com/security/cve/CVE-2026-41506"
},
{
"category": "external",
"summary": "SUSE Bug 1264854 for CVE-2026-41506",
"url": "https://bugzilla.suse.com/1264854"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2026-41506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22249-1
Vulnerability from csaf_suse - Published: 2026-06-22 09:04 - Updated: 2026-06-22 09:04Summary
Security update for google-osconfig-agent
Severity
Important
Notes
Title of the patch: Security update for google-osconfig-agent
Description of the patch: This update for google-osconfig-agent fixes the following issues
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.
- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents
(bsc#1251453).
- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially
crafted input (bsc#1251704).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260264).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265762).
- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of
service (bsc#1262926).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266171).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266171).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during
smart-HTTP clone and fetch operations (bsc#1264923).
Changes for google-osconfig-agent:
- Update to version 20260615.01
* Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
- from version 20260615.00
* Add unit tests for ospatch_apt_upgrade.go (#938)
- Update to version 20260611.00
* Add unit tests for policies/policies.go PART 5 (#998)
- from version 20260610.00
* Add unit tests for policies/policies.go PART 4 (#997)
- from version 20260609.02
* squash commits (#936)
- from version 20260609.01
* Add unit tests for policies/policies.go PART 3 (#996)
- from version 20260609.00
* Add unit tests for policies/policies.go PART 2 (#991)
- from version 20260602.01
* Align format of dates and timestamp collected across Windows packages (#973)
- from version 20260602.00
* Add unit tests for config/config,go (#979)
- from version 20260528.00
* Bump github.com/containerd/containerd (#990)
- from version 20260521.00
* Cover agentconfig functionality by unit tests (#925)
- from version 20260520.04
* Add unit tests for policies/googet.go (#961)
* Bump github.com/go-git/go-git/v5 (#987)
- from version 20260520.02
* Add unit tests for policies/yum.go (#952)
* Add unit tests for policies/apt.go PART 3 (#951)
- from version 20260520.00
* Add unit tests for policies/zypper.go (#953)
- from version 20260519.00
* Add unit tests for policies/policies.go PART 1 (#949)
- from version 20260513.01
* Bump github.com/go-git/go-git/v5 (#981), this also updates
golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
- from version 20260513.00
* upgrade a few packages (#980)
- from version 20260512.02
* Add/improve unit tests for agentendpoint/exec_task.go (#933)
- from version 20260512.01
* Cover google_update.go by unit tests (#941)
- from version 20260512.00
* Change zone for arm64 builds because of stockout (#978)
- Update to version 20260511.00
* switch to t2a-standard-2 on ARM package build (#977)
- from version 20260505.03
* Cover zypper_patch by unit tests (#958)
- from version 20260505.02
* Remove unused functions DisableAutoUpdates (#970)
- from version 20260505.01
* Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)
- from version 20260505.00
* Upgrade a few dependencies across the repo (#968)
+ github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506)
+ github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986)
+ github.com/go-viper/mapstructure/v2 2.3.0->2.4.0
+ go.opentelemetry.io/otel 1.40.0->1.41.0
+ go.opentelemetry.io/otel/sdk 1.39.0->1.43.0
- from version 20260504.01
* bump github.com/docker/cli to 29.2.0 (#962)
- from version 20260504.00
* Bump github.com/opencontainers/selinux (#960)
- Update to version 20260428.00
* Add/improve unit tests for agentendpoint/agentendpoint.go (#930)
- from version 20260427.03
* Cover config/file.go by unit tests (#935)
- from version 20260422.01
* Cover patch_linux.go by unit tests (#932)
- from version 20260422.00
* upgrade grpc package in main package and e2e tests (#959)
(bsc#1260264, CVE-2026-33186)
- from version 20260417.04
* Bump OSV-Scalibr version to v0.4.3 (#956)
- from version 20260417.03
* Add unit tests for updates_linux.go (#937)
- from version 20260417.02
* Add zone to CreateDisk step (#955)
- from version 20260417.01
* Change disk type for deb11 (#954)
- from version 20260417.00
* Add unit tests for policies/apt.go PART 1 (#950)
- from version 20260410.02
* Add unit tests for packages/pty_linux.go (#943)
- from version 20260410.01
* fix disk type for arm workflows (#948)
- from version 20260410.00
* Change machine type for arm based workflows (#946)
- Update to version 20260330.00
* bump timeouts for all workflows (#940)
- from version 20260326.00
* Cover exec_resource.go by unit tests (#934)
- from version 20260318.00
* Integrate OSConfig agent with ReportVmInventory (#923)
- from version 20260313.02
* remove cacheonly flag from yum upgrade (#924)
- from version 20260313.01
* conditions python version override (#927)
- from version 20260313.00
* Fix presubmits by explicitly set python version for rpm based systems (#926)
- from version 20260311.00
* Bump osconfig version (#922)
- from version 20260309.02
* Extend OSV scalibr extractor (#921)
- from version 20260309.01
* upgrade golang.org/x/crypto and it's transitive deps (#918)
- from version 20260309.00
* Add purl to pkg info (#920)
- from version 20260306.00
* Add 'Type' field to PkgInfo (#919)
- from version 20260303.01
* Upgrade go.opentelemetry.io/otel/sdk (#913)
- from version 20260303.00
* Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)
- from version 20260302.00
* Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)
- from version 20260126.00
* Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)
* Bump github.com/sirupsen/logrus (#894)
- Update to version 20260119.00
* Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)
- Update to version 20251230.00
* chore: Migrate gsutil usage to gcloud storage (#904)
- from version 20251223.00
* fix e2e tests for report inventory (#903)
- from version 20251222.01
* Revert "Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)" (#902)
- from version 20251222.00
* Bump golang to the new version (#900)
- from version 20251218.00
* add new CODEOWNERS (#901)
- from version 20251217.00
* Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)
- Bump the golang compiler version to 1.24.5
- Update to version 20251202.00
* Revert "Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)" (#893)
- Update to version 20251201.00
* Revert "Bump github.com/containerd/containerd (#890)" (#892)
- Update to version 20251126.00
* Bump github.com/containerd/containerd (#890)
* Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)
- Update to version 20251028.00
* Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)
* Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)
- from version 20251023.02
* Create multiple_os.yaml (#883)
- from version 20251023.00
* Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)
* Add test runner for e2e tests (#876)
- Update to version 20250925.00
* Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)
* Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)
* Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)
* Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)
- Update to version 20250902.01
* Bump github.com/googleapis/enterprise-certificate-proxy (#829)
- from version 20250902.00
* update github.com/go-jose/go-jose/v4 (#869)
* Upgrade scalibr and other deps (#866)
- from version 20250901.00
* Fix possibility of path traversal for zip and tar archival (#868)
- from version 20250825.00
* set CODEOWNERS file as required by org (#863)
- from version 20250819.00
* Fix/rhel10 build centos image (#860)
- from version 20250814.00
* Fix/rhel10 build image (#859)
- from version 20250813.00
* Fix: Add RHEL 10 support to RPM startup script (#858)
- from version 20250811.00
* Remove old/sles-15-sp4-sap as image is deprecated (#857)
- Update to version 20250806.00
* Fixed JSON identifier for the universe domain (#855)
- from version 20250729.00
* Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)
- from version 20250725.02
* Update utils.go (#854)
* Upgrade golang.org/x/oauth2 package to the latest. (#853)
* Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)
- from version 20250725.01
* Bump golang.org/x/oauth2 (#848)
* Port fix for debian 11 to goo package manager. (#852)
- from version 20250725.00
* Update Golang version in common.sh and skip backports
repo for debian 11 (#850)
- from version 20250723.01
* Add workflows to build package for el10 (#849)
- from version 20250721.00
* Make OS Config agent TPC aware (#846)
- from version 20250718.00
* Create workflows for new Debian 13. (#847)
- Update to version 20250703.00
* Fix sles images (#844)
- from version 20250702.00
* Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)
- from version 20250701.00
* Bump the go_modules group across 1 directory with 2 updates (#840)
- Update to version 20250606.00
* Change base docker images Google's official base images. (#838)
- Update to version 20250523.01
* Add a simple no-op OS policy for user testing (#837)
- from version 20250523.00
* Introduce scalibr inventory extractor for dpkg/rpm/cos
os/filesystem extractors (linux) (#834)
* Trace GetInstalledPackages memory levels (#835)
- from version 20250520.00
- Update to version 20250513.00
* Fix rpm extractor, handle (none) value correctly. (#833)
- from version 20250512.01
* Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)
- from version 20250512.00
* Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)
- from version 20250508.01
* cosmetic refactoring to osinfo package (#826)
- from version 20250508.00
* Refactor /inventory with dependency injection (#825)
* Add debian, ubuntu (InstalledDebPackages) snapshots (#821)
* cover packages_linux.go file with tests (#824)
* Add debian (10,11,12) GetPackageUpdates output snapshots (#822)
- from version 20250507.00
* Add InstalledRPMPackages snapshot tests (#823)
- from version 20250506.02
* Yum tests: simplify initialization of exit errors (#820)
- from version 20250506.01
* Improve test coverage for gem package manager (#818)
- from version 20250506.00
* after go/x/crypto update 0.32.0 -> 0.37.0 (#817)
- from version 20250505.01
* Improve packages package coverage (#814)
* Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)
- from version 20250505.00
* Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)
- from version 20250430.00
* Snapshot YumUpdates (GetPackageUpdates) output (#813)
- from version 20250428.00
* Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output
for sles 12, 15 testdata (#812)
- from version 20250423.00
* Introduce MatchSnapshot large test results matcher function, snapshot
apt-deb GetPackageUpdates (#811)
- from version 20250416.02
Patchnames: SUSE-SLE-Micro-6.1-587
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
82 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-osconfig-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-osconfig-agent fixes the following issues\n\n- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers.\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n (bsc#1251453).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n crafted input (bsc#1251704).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260264).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265762).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n service (bsc#1262926).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266603).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266171).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266171).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).\n - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n smart-HTTP clone and fetch operations (bsc#1264923).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260615.01\n * Upgrade golang.org/x/crypto \u0026 golang.org/x/net (#1006)\n- from version 20260615.00\n * Add unit tests for ospatch_apt_upgrade.go (#938)\n- Update to version 20260611.00\n * Add unit tests for policies/policies.go PART 5 (#998)\n- from version 20260610.00\n * Add unit tests for policies/policies.go PART 4 (#997)\n- from version 20260609.02\n * squash commits (#936)\n- from version 20260609.01\n * Add unit tests for policies/policies.go PART 3 (#996)\n- from version 20260609.00\n * Add unit tests for policies/policies.go PART 2 (#991)\n- from version 20260602.01\n * Align format of dates and timestamp collected across Windows packages (#973)\n- from version 20260602.00\n * Add unit tests for config/config,go (#979)\n- from version 20260528.00\n * Bump github.com/containerd/containerd (#990)\n- from version 20260521.00\n * Cover agentconfig functionality by unit tests (#925)\n- from version 20260520.04\n * Add unit tests for policies/googet.go (#961)\n * Bump github.com/go-git/go-git/v5 (#987)\n- from version 20260520.02\n * Add unit tests for policies/yum.go (#952)\n * Add unit tests for policies/apt.go PART 3 (#951)\n- from version 20260520.00\n * Add unit tests for policies/zypper.go (#953)\n- from version 20260519.00\n * Add unit tests for policies/policies.go PART 1 (#949)\n- from version 20260513.01\n * Bump github.com/go-git/go-git/v5 (#981), this also updates\n golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)\n- from version 20260513.00\n * upgrade a few packages (#980)\n- from version 20260512.02\n * Add/improve unit tests for agentendpoint/exec_task.go (#933)\n- from version 20260512.01\n * Cover google_update.go by unit tests (#941)\n- from version 20260512.00\n * Change zone for arm64 builds because of stockout (#978)\n- Update to version 20260511.00\n * switch to t2a-standard-2 on ARM package build (#977)\n- from version 20260505.03\n * Cover zypper_patch by unit tests (#958)\n- from version 20260505.02\n * Remove unused functions DisableAutoUpdates (#970)\n- from version 20260505.01\n * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)\n- from version 20260505.00\n * Upgrade a few dependencies across the repo (#968)\n + github.com/go-git/go-git/v5 5.16.2-\u003e5.18.0 (bsc#1264923, CVE-2026-41506)\n + github.com/go-jose/go-jose/v4 4.1.3-\u003e4.1.4 (bsc#1262926, CVE-2026-34986)\n + github.com/go-viper/mapstructure/v2 2.3.0-\u003e2.4.0\n + go.opentelemetry.io/otel 1.40.0-\u003e1.41.0\n + go.opentelemetry.io/otel/sdk 1.39.0-\u003e1.43.0\n- from version 20260504.01\n * bump github.com/docker/cli to 29.2.0 (#962)\n- from version 20260504.00\n * Bump github.com/opencontainers/selinux (#960)\n- Update to version 20260428.00\n * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)\n- from version 20260427.03\n * Cover config/file.go by unit tests (#935)\n- from version 20260422.01\n * Cover patch_linux.go by unit tests (#932)\n- from version 20260422.00\n * upgrade grpc package in main package and e2e tests (#959)\n (bsc#1260264, CVE-2026-33186)\n- from version 20260417.04\n * Bump OSV-Scalibr version to v0.4.3 (#956)\n- from version 20260417.03\n * Add unit tests for updates_linux.go (#937)\n- from version 20260417.02\n * Add zone to CreateDisk step (#955)\n- from version 20260417.01\n * Change disk type for deb11 (#954)\n- from version 20260417.00\n * Add unit tests for policies/apt.go PART 1 (#950)\n- from version 20260410.02\n * Add unit tests for packages/pty_linux.go (#943)\n- from version 20260410.01\n * fix disk type for arm workflows (#948)\n- from version 20260410.00\n * Change machine type for arm based workflows (#946)\n- Update to version 20260330.00\n * bump timeouts for all workflows (#940)\n- from version 20260326.00\n * Cover exec_resource.go by unit tests (#934)\n- from version 20260318.00\n * Integrate OSConfig agent with ReportVmInventory (#923)\n- from version 20260313.02\n * remove cacheonly flag from yum upgrade (#924)\n- from version 20260313.01\n * conditions python version override (#927)\n- from version 20260313.00\n * Fix presubmits by explicitly set python version for rpm based systems (#926)\n- from version 20260311.00\n * Bump osconfig version (#922)\n- from version 20260309.02\n * Extend OSV scalibr extractor (#921)\n- from version 20260309.01\n * upgrade golang.org/x/crypto and it\u0027s transitive deps (#918)\n- from version 20260309.00\n * Add purl to pkg info (#920)\n- from version 20260306.00\n * Add \u0027Type\u0027 field to PkgInfo (#919)\n- from version 20260303.01\n * Upgrade go.opentelemetry.io/otel/sdk (#913)\n- from version 20260303.00\n * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)\n- from version 20260302.00\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)\n- from version 20260126.00\n * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)\n * Bump github.com/sirupsen/logrus (#894)\n- Update to version 20260119.00\n * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)\n- Update to version 20251230.00\n * chore: Migrate gsutil usage to gcloud storage (#904)\n- from version 20251223.00\n * fix e2e tests for report inventory (#903)\n- from version 20251222.01\n * Revert \"Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\" (#902)\n- from version 20251222.00\n * Bump golang to the new version (#900)\n- from version 20251218.00\n * add new CODEOWNERS (#901)\n- from version 20251217.00\n * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\n- Bump the golang compiler version to 1.24.5\n- Update to version 20251202.00\n * Revert \"Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\" (#893)\n- Update to version 20251201.00\n * Revert \"Bump github.com/containerd/containerd (#890)\" (#892)\n- Update to version 20251126.00\n * Bump github.com/containerd/containerd (#890)\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\n- Update to version 20251028.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)\n * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)\n- from version 20251023.02\n * Create multiple_os.yaml (#883)\n- from version 20251023.00\n * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)\n * Add test runner for e2e tests (#876)\n- Update to version 20250925.00\n * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)\n * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)\n * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)\n * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)\n- Update to version 20250902.01\n * Bump github.com/googleapis/enterprise-certificate-proxy (#829)\n- from version 20250902.00\n * update github.com/go-jose/go-jose/v4 (#869)\n * Upgrade scalibr and other deps (#866)\n- from version 20250901.00\n * Fix possibility of path traversal for zip and tar archival (#868)\n- from version 20250825.00\n * set CODEOWNERS file as required by org (#863)\n- from version 20250819.00\n * Fix/rhel10 build centos image (#860)\n- from version 20250814.00\n * Fix/rhel10 build image (#859)\n- from version 20250813.00\n * Fix: Add RHEL 10 support to RPM startup script (#858)\n- from version 20250811.00\n * Remove old/sles-15-sp4-sap as image is deprecated (#857)\n- Update to version 20250806.00\n * Fixed JSON identifier for the universe domain (#855)\n- from version 20250729.00\n * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)\n- from version 20250725.02\n * Update utils.go (#854)\n * Upgrade golang.org/x/oauth2 package to the latest. (#853)\n * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)\n- from version 20250725.01\n * Bump golang.org/x/oauth2 (#848)\n * Port fix for debian 11 to goo package manager. (#852)\n- from version 20250725.00\n * Update Golang version in common.sh and skip backports\n repo for debian 11 (#850)\n- from version 20250723.01\n * Add workflows to build package for el10 (#849)\n- from version 20250721.00\n * Make OS Config agent TPC aware (#846)\n- from version 20250718.00\n * Create workflows for new Debian 13. (#847)\n- Update to version 20250703.00\n * Fix sles images (#844)\n- from version 20250702.00\n * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)\n- from version 20250701.00\n * Bump the go_modules group across 1 directory with 2 updates (#840)\n- Update to version 20250606.00\n * Change base docker images Google\u0027s official base images. (#838)\n- Update to version 20250523.01\n * Add a simple no-op OS policy for user testing (#837)\n- from version 20250523.00\n * Introduce scalibr inventory extractor for dpkg/rpm/cos\n os/filesystem extractors (linux) (#834)\n * Trace GetInstalledPackages memory levels (#835)\n- from version 20250520.00\n- Update to version 20250513.00\n * Fix rpm extractor, handle (none) value correctly. (#833)\n- from version 20250512.01\n * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)\n- from version 20250512.00\n * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)\n- from version 20250508.01\n * cosmetic refactoring to osinfo package (#826)\n- from version 20250508.00\n * Refactor /inventory with dependency injection (#825)\n * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)\n * cover packages_linux.go file with tests (#824)\n * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)\n- from version 20250507.00\n * Add InstalledRPMPackages snapshot tests (#823)\n- from version 20250506.02\n * Yum tests: simplify initialization of exit errors (#820)\n- from version 20250506.01\n * Improve test coverage for gem package manager (#818)\n- from version 20250506.00\n * after go/x/crypto update 0.32.0 -\u003e 0.37.0 (#817)\n- from version 20250505.01\n * Improve packages package coverage (#814)\n * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)\n- from version 20250505.00\n * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)\n- from version 20250430.00\n * Snapshot YumUpdates (GetPackageUpdates) output (#813)\n- from version 20250428.00\n * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output\n for sles 12, 15 testdata (#812)\n- from version 20250423.00\n * Introduce MatchSnapshot large test results matcher function, snapshot\n apt-deb GetPackageUpdates (#811)\n- from version 20250416.02\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-587",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22249-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22249-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622249-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22249-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047615.html"
},
{
"category": "self",
"summary": "SUSE Bug 1210938",
"url": "https://bugzilla.suse.com/1210938"
},
{
"category": "self",
"summary": "SUSE Bug 1251453",
"url": "https://bugzilla.suse.com/1251453"
},
{
"category": "self",
"summary": "SUSE Bug 1251704",
"url": "https://bugzilla.suse.com/1251704"
},
{
"category": "self",
"summary": "SUSE Bug 1260264",
"url": "https://bugzilla.suse.com/1260264"
},
{
"category": "self",
"summary": "SUSE Bug 1262926",
"url": "https://bugzilla.suse.com/1262926"
},
{
"category": "self",
"summary": "SUSE Bug 1264923",
"url": "https://bugzilla.suse.com/1264923"
},
{
"category": "self",
"summary": "SUSE Bug 1265762",
"url": "https://bugzilla.suse.com/1265762"
},
{
"category": "self",
"summary": "SUSE Bug 1266171",
"url": "https://bugzilla.suse.com/1266171"
},
{
"category": "self",
"summary": "SUSE Bug 1266603",
"url": "https://bugzilla.suse.com/1266603"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-45288 page",
"url": "https://www.suse.com/security/cve/CVE-2023-45288/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22868 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22868/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-34986 page",
"url": "https://www.suse.com/security/cve/CVE-2026-34986/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for google-osconfig-agent",
"tracking": {
"current_release_date": "2026-06-22T09:04:46Z",
"generator": {
"date": "2026-06-22T09:04:46Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22249-1",
"initial_release_date": "2026-06-22T09:04:46Z",
"revision_history": [
{
"date": "2026-06-22T09:04:46Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"product": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"product": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"product": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64",
"product": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64",
"product_id": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-45288",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-45288"
}
],
"notes": [
{
"category": "general",
"text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-45288",
"url": "https://www.suse.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "SUSE Bug 1221400 for CVE-2023-45288",
"url": "https://bugzilla.suse.com/1221400"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "moderate"
}
],
"title": "CVE-2023-45288"
},
{
"cve": "CVE-2025-22868",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22868"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22868",
"url": "https://www.suse.com/security/cve/CVE-2025-22868"
},
{
"category": "external",
"summary": "SUSE Bug 1239185 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239185"
},
{
"category": "external",
"summary": "SUSE Bug 1239186 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239186"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2025-22868"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
},
{
"category": "external",
"summary": "SUSE Bug 1268676 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1268676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-34986",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-34986"
}
],
"notes": [
{
"category": "general",
"text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-34986",
"url": "https://www.suse.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "SUSE Bug 1262805 for CVE-2026-34986",
"url": "https://bugzilla.suse.com/1262805"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-34986"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-41506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41506"
}
],
"notes": [
{
"category": "general",
"text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41506",
"url": "https://www.suse.com/security/cve/CVE-2026-41506"
},
{
"category": "external",
"summary": "SUSE Bug 1264854 for CVE-2026-41506",
"url": "https://bugzilla.suse.com/1264854"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "moderate"
}
],
"title": "CVE-2026-41506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20260615.01-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:04:46Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
SUSE-SU-2026:22376-1
Vulnerability from csaf_suse - Published: 2026-06-26 08:29 - Updated: 2026-06-26 08:29Summary
Security update for google-guest-agent
Severity
Important
Notes
Title of the patch: Security update for google-guest-agent
Description of the patch: This update for google-guest-agent fixes the following issues
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260264).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266171).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266171).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
Changes for google-guest-agent:
- Update to version 20260529.00
* Dependency updates (#616)
- from version 20260522.00
* Fix improper umask calculation on socket creation (#614)
- from version 20260520.01
* Update OWNERS (#609)
* Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)
- Update to version 20250506.01 (bsc#1243254, bsc#1243505)
Patchnames: SUSE-SLES-16.0-1091
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
55 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-guest-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-guest-agent fixes the following issues\n\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260264).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266603).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n (bsc#1266171).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266171).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).\n\nChanges for google-guest-agent:\n\n- Update to version 20260529.00\n * Dependency updates (#616)\n- from version 20260522.00\n * Fix improper umask calculation on socket creation (#614)\n- from version 20260520.01\n * Update OWNERS (#609)\n * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)\n- Update to version 20250506.01 (bsc#1243254, bsc#1243505)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1091",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22376-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22376-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622376-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22376-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047763.html"
},
{
"category": "self",
"summary": "SUSE Bug 1243254",
"url": "https://bugzilla.suse.com/1243254"
},
{
"category": "self",
"summary": "SUSE Bug 1243505",
"url": "https://bugzilla.suse.com/1243505"
},
{
"category": "self",
"summary": "SUSE Bug 1260264",
"url": "https://bugzilla.suse.com/1260264"
},
{
"category": "self",
"summary": "SUSE Bug 1266171",
"url": "https://bugzilla.suse.com/1266171"
},
{
"category": "self",
"summary": "SUSE Bug 1266603",
"url": "https://bugzilla.suse.com/1266603"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for google-guest-agent",
"tracking": {
"current_release_date": "2026-06-26T08:29:53Z",
"generator": {
"date": "2026-06-26T08:29:53Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22376-1",
"initial_release_date": "2026-06-26T08:29:53Z",
"revision_history": [
{
"date": "2026-06-26T08:29:53Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260529.00-160000.1.1.aarch64",
"product": {
"name": "google-guest-agent-20260529.00-160000.1.1.aarch64",
"product_id": "google-guest-agent-20260529.00-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-guest-agent-20260529.00-160000.1.1.x86_64",
"product": {
"name": "google-guest-agent-20260529.00-160000.1.1.x86_64",
"product_id": "google-guest-agent-20260529.00-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64"
},
"product_reference": "google-guest-agent-20260529.00-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-guest-agent-20260529.00-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
},
"product_reference": "google-guest-agent-20260529.00-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
},
{
"category": "external",
"summary": "SUSE Bug 1268676 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1268676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:google-guest-agent-20260529.00-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T08:29:53Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…