{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC86BFF1-BD22-41C9-9BAB-7C673CBEDB0F",
              "versionEndExcluding": "42.7.11",
              "versionStartIncluding": "42.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11."
    }
  ],
  "id": "CVE-2026-42198",
  "lastModified": "2026-05-01T12:51:20.853",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-29T16:16:25.427",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.postgresql:postgresql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "42.2.0"
            },
            {
              "fixed": "42.7.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T20:09:36Z",
    "nvd_published_at": "2026-04-29T16:16:25Z",
    "severity": "HIGH"
  },
  "details": "## Summary\npgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.\n\n### Impact\nA malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count.\nWith a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail.\nA single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.\n\nIn affected versions, `loginTimeout` did not fully mitigate this problem. When `loginTimeout` expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.\n\nThis issue affects availability. It does **not** provide authentication bypass, privilege escalation, or direct password disclosure.\n\nA user is vulnerable when **all** of the following are true:\n\n1. The connection uses **SCRAM-SHA-256** authentication.\n2. The client reaches a **malicious, compromised, or attacker-controlled PostgreSQL endpoint**.\n3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the `server-first-message`.\n\nIn practice, that can happen in these situations:\n\n- the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control\n- the application accepts connection strings, hostnames, or JDBC URLs from user input, configuration uploaded by users, or other untrusted sources\n- the application is configured to connect to a PostgreSQL server that is itself malicious or later becomes compromised\n- the application connects through an untrusted proxy, relay, tunnel, bastion, or connection-pooling service that can act as the PostgreSQL server\n- an attacker can redirect the client to a fake PostgreSQL endpoint by manipulating DNS, service discovery, Kubernetes service resolution, `/etc/hosts`, environment variables, or similar indirection\n- an active network attacker on the path can impersonate the server because the connection does not strongly verify server identity (for example, `sslmode` lower than `verify-full`, or trusting a CA that signs hosts outside the operator\u0027s control)\n\nThe issue is **more damaging** when the application uses connection retries, many parallel connection attempts, or `loginTimeout` and assumes the timeout fully stops the work.\n\n### Patches\nThe patch introduces a new connection property, `scramMaxIterations`, with a default of 100K. The client now rejects SCRAM server messages that advertise more PBKDF2 iterations than the configured cap before starting the PBKDF2 computation begins.\n\n### Workarounds\n\nUntil a patched version of pgjdbc is deployed, the following measures reduce exposure:\n\n1. **Only connect to trusted PostgreSQL servers whose identity is verified.**  \n   Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA.\n   TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.\n\n2. **Do not rely on `loginTimeout` as a complete mitigation on unpatched versions.**  \n   On affected versions, `loginTimeout` can stop the waiting caller while the worker thread continues spending CPU.\n\n3. **Avoid SCRAM on untrusted or interceptable connection paths.**  \n   For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.\n\n4. **Reduce blast radius operationally.**  \n   Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.\n\n5. **On trusted servers you control, keep SCRAM iteration counts at ordinary values.**  \n   This does not defend against an attacker-controlled server, but it avoids unnecessary client cost when talking to legitimate servers.",
  "id": "GHSA-98qh-xjc8-98pq",
  "modified": "2026-05-05T20:09:36Z",
  "published": "2026-05-05T20:09:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42198"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pgjdbc/pgjdbc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.27.3.SP2 includes the following CVE fix:\n\n* pgjdbc: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication [quarkus-3.27] (CVE-2026-42198)\n\nFor more information, see the release notes page listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:19098",
        "url": "https://access.redhat.com/errata/RHSA-2026:19098"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/quarkus/",
        "url": "https://access.redhat.com/products/quarkus/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.3.SP2",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.3.SP2"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27"
      },
      {
        "category": "external",
        "summary": "QUARKUS-7768",
        "url": "https://issues.redhat.com/browse/QUARKUS-7768"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19098.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.27.3.SP2 security update",
    "tracking": {
      "current_release_date": "2026-05-20T16:10:04+00:00",
      "generator": {
        "date": "2026-05-20T16:10:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2026:19098",
      "initial_release_date": "2026-05-20T12:47:06+00:00",
      "revision_history": [
        {
          "date": "2026-05-20T12:47:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-20T12:47:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-20T16:10:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.27.3.SP2",
                "product": {
                  "name": "Red Hat build of Quarkus 3.27.3.SP2",
                  "product_id": "Red Hat build of Quarkus 3.27.3.SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.27::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42198",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-29T17:00:59.186447+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 (Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256) authentication with an excessively large iteration count. This causes the client to spend an unbounded amount of CPU time performing PBKDF2 (Password-Based Key Derivation Function 2) computations, leading to a client-side Denial of Service (DoS). This can exhaust client CPU resources and wedge connection pools.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.3.SP2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42198"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42198",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42198"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42198",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42198"
        },
        {
          "category": "external",
          "summary": "https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11",
          "url": "https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"
        },
        {
          "category": "external",
          "summary": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq",
          "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"
        }
      ],
      "release_date": "2026-04-29T15:58:49.174000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-20T12:47:06+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.3.SP2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:19098"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.3.SP2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.\r\nBitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.\r\nConfluence ist eine kommerzielle Wiki-Software.\r\nCrucible ist eine Code-Review-L\u00f6sung f\u00fcr Unternehmensteams.\r\nFisheye ist ein Quellcode-Repository-Browser f\u00fcr Unternehmensteams. \r\nJira ist eine Webanwendung zur Softwareentwicklung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuf\u00fchren, um einen Denial of Service Angriff durchzuf\u00fchren, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren, und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1608 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1608.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1608 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1608"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin Mai vom 2026-05-19",
        "url": "https://confluence.atlassian.com/security/security-bulletin-may-19-2026-1786839142.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19098 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19098"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-20T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-21T07:35:45.292+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1608",
      "initial_release_date": "2026-05-19T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-19T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-20T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c12.1.7",
                "product": {
                  "name": "Atlassian Bamboo Data Center LTS \u003c12.1.7",
                  "product_id": "T054387"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 12.1.7",
                "product": {
                  "name": "Atlassian Bamboo Data Center LTS 12.1.7",
                  "product_id": "T054387-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center_lts__12.1.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c10.2.19",
                "product": {
                  "name": "Atlassian Bamboo Data Center LTS \u003c10.2.19",
                  "product_id": "T054388"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 10.2.19",
                "product": {
                  "name": "Atlassian Bamboo Data Center LTS 10.2.19",
                  "product_id": "T054388-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center_lts__10.2.19"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c9.6.26",
                "product": {
                  "name": "Atlassian Bamboo Data Center LTS \u003c9.6.26",
                  "product_id": "T054389"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 9.6.26",
                "product": {
                  "name": "Atlassian Bamboo Data Center LTS 9.6.26",
                  "product_id": "T054389-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center_lts__9.6.26"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c10.2.2",
                "product": {
                  "name": "Atlassian Bitbucket Data Center LTS \u003c10.2.2",
                  "product_id": "T054391"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 10.2.2",
                "product": {
                  "name": "Atlassian Bitbucket Data Center LTS 10.2.2",
                  "product_id": "T054391-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center_lts__10.2.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c9.4.19",
                "product": {
                  "name": "Atlassian Bitbucket Data Center LTS \u003c9.4.19",
                  "product_id": "T054392"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 9.4.19",
                "product": {
                  "name": "Atlassian Bitbucket Data Center LTS 9.4.19",
                  "product_id": "T054392-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center_lts__9.4.19"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bitbucket"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c10.2.11",
                "product": {
                  "name": "Atlassian Confluence Data Center LTS \u003c10.2.11",
                  "product_id": "T054393"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 10.2.11",
                "product": {
                  "name": "Atlassian Confluence Data Center LTS 10.2.11",
                  "product_id": "T054393-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center_lts__10.2.11"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c9.2.20",
                "product": {
                  "name": "Atlassian Confluence Data Center LTS \u003c9.2.20",
                  "product_id": "T054394"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 9.2.20",
                "product": {
                  "name": "Atlassian Confluence Data Center LTS 9.2.20",
                  "product_id": "T054394-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center_lts__9.2.20"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Confluence"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.9.10",
                "product": {
                  "name": "Atlassian Crucible \u003c4.9.10",
                  "product_id": "T054395"
                }
              },
              {
                "category": "product_version",
                "name": "4.9.10",
                "product": {
                  "name": "Atlassian Crucible 4.9.10",
                  "product_id": "T054395-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:crucible:4.9.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Crucible"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.9.10",
                "product": {
                  "name": "Atlassian Fisheye \u003c4.9.10",
                  "product_id": "T054396"
                }
              },
              {
                "category": "product_version",
                "name": "4.9.10",
                "product": {
                  "name": "Atlassian Fisheye 4.9.10",
                  "product_id": "T054396-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:fisheye:4.9.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Fisheye"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c11.3.5",
                "product": {
                  "name": "Atlassian Jira Data Center LTS \u003c11.3.5",
                  "product_id": "T054397"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 11.3.5",
                "product": {
                  "name": "Atlassian Jira Data Center LTS 11.3.5",
                  "product_id": "T054397-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:data_center_lts__11.3.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center LTS \u003c10.3.20",
                "product": {
                  "name": "Atlassian Jira Data Center LTS \u003c10.3.20",
                  "product_id": "T054398"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center LTS 10.3.20",
                "product": {
                  "name": "Atlassian Jira Data Center LTS 10.3.20",
                  "product_id": "T054398-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:data_center_lts__10.3.20"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "LTS \u003c9.12.35",
                "product": {
                  "name": "Atlassian Jira LTS \u003c9.12.35",
                  "product_id": "T054399"
                }
              },
              {
                "category": "product_version",
                "name": "LTS 9.12.35",
                "product": {
                  "name": "Atlassian Jira LTS 9.12.35",
                  "product_id": "T054399-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:lts__9.12.35"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Jira"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-13990",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2019-13990"
    },
    {
      "cve": "CVE-2022-1471",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2022-1471"
    },
    {
      "cve": "CVE-2022-23521",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2022-23521"
    },
    {
      "cve": "CVE-2022-41903",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2022-41903"
    },
    {
      "cve": "CVE-2023-22518",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2023-22518"
    },
    {
      "cve": "CVE-2023-22522",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2023-22522"
    },
    {
      "cve": "CVE-2023-22523",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2023-22523"
    },
    {
      "cve": "CVE-2023-22524",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2023-22524"
    },
    {
      "cve": "CVE-2023-22527",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2023-22527"
    },
    {
      "cve": "CVE-2023-24998",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2023-24998"
    },
    {
      "cve": "CVE-2023-46604",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2023-46604"
    },
    {
      "cve": "CVE-2024-45801",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2024-45801"
    },
    {
      "cve": "CVE-2025-52999",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2025-52999"
    },
    {
      "cve": "CVE-2025-67030",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2025-67030"
    },
    {
      "cve": "CVE-2026-22029",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-22029"
    },
    {
      "cve": "CVE-2026-22732",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-22732"
    },
    {
      "cve": "CVE-2026-24734",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-24734"
    },
    {
      "cve": "CVE-2026-24880",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-24880"
    },
    {
      "cve": "CVE-2026-25639",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-25639"
    },
    {
      "cve": "CVE-2026-26960",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-26960"
    },
    {
      "cve": "CVE-2026-27727",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-27727"
    },
    {
      "cve": "CVE-2026-27830",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-27830"
    },
    {
      "cve": "CVE-2026-29062",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-29062"
    },
    {
      "cve": "CVE-2026-29129",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-29129"
    },
    {
      "cve": "CVE-2026-29145",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-29145"
    },
    {
      "cve": "CVE-2026-29146",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-29146"
    },
    {
      "cve": "CVE-2026-29786",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-29786"
    },
    {
      "cve": "CVE-2026-31802",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-31802"
    },
    {
      "cve": "CVE-2026-33750",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-33750"
    },
    {
      "cve": "CVE-2026-34483",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-34483"
    },
    {
      "cve": "CVE-2026-34487",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-34487"
    },
    {
      "cve": "CVE-2026-39304",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-39304"
    },
    {
      "cve": "CVE-2026-42198",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-42198"
    },
    {
      "cve": "CVE-2026-5598",
      "product_status": {
        "known_affected": [
          "T054387",
          "T054398",
          "T054397",
          "T054396",
          "T054395",
          "T054394",
          "67646",
          "T054393",
          "T054392",
          "T054391",
          "T054389",
          "T054388",
          "T054399"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-5598"
    }
  ]
}