Vulnerability-Lookup

RHSA-2026:16874

Vulnerability from csaf_redhat - Published: 2026-05-13 07:11 - Updated: 2026-05-15 21:06

Summary

Red Hat Security Advisory: Network Observability 1.11.2 for OpenShift

Severity

Important

Notes

Topic: Network Observability 1.11 for Red Hat OpenShift.

Details: Network flows collector and monitoring solution.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-62718

A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.

7.0 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x	—	Workaround

Threats

Impact Important

CVE-2025-69873

A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1333 - Inefficient Regular Expression Complexity

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix Workaround

Known not affected 21 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x	—	Workaround

Threats

Impact Important

CVE-2026-4800

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x	—	Workaround

Threats

Impact Important

CVE-2026-25679

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x	—	Vendor Fix fix Workaround

Known not affected 21 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x	—	Workaround

Threats

Impact Important

CVE-2026-32280

A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x	—	Vendor Fix fix

Known not affected 21 products

Product	Identifier	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x		—

Threats

Impact Important

CVE-2026-32282

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64	—	Vendor Fix fix Workaround

Known not affected 21 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x	—	Workaround

Threats

Impact Moderate

CVE-2026-40175

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.

9.0 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x		—

Threats

Impact Important

CVE-2026-40895

A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x		—

Threats

Impact Important

CVE-2026-42033

A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x		—

Threats

Impact Important

CVE-2026-42035

A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application's core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64	—	Workaround
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x	—	Workaround

Threats

Impact Moderate

CVE-2026-42039

A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix

Known not affected 21 products

Product	Identifier	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x		—

Threats

Impact Important

CVE-2026-42041

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x		—

Threats

Impact Important

CVE-2026-42043

A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64	—	Vendor Fix fix
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64		—
Unresolved product id: Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x		—

Threats

Impact Important

References

99 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:16874	self
https://access.redhat.com/security/cve/CVE-2025-62718	external
https://access.redhat.com/security/cve/CVE-2025-69873	external
https://access.redhat.com/security/cve/CVE-2026-25679	external
https://access.redhat.com/security/cve/CVE-2026-32280	external
https://access.redhat.com/security/cve/CVE-2026-32282	external
https://access.redhat.com/security/cve/CVE-2026-40175	external
https://access.redhat.com/security/cve/CVE-2026-40895	external
https://access.redhat.com/security/cve/CVE-2026-42033	external
https://access.redhat.com/security/cve/CVE-2026-42035	external
https://access.redhat.com/security/cve/CVE-2026-42039	external
https://access.redhat.com/security/cve/CVE-2026-42041	external
https://access.redhat.com/security/cve/CVE-2026-42043	external
https://access.redhat.com/security/cve/CVE-2026-4800	external
https://access.redhat.com/security/updates/classi…	external
https://docs.openshift.com/container-platform/lat…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-62718	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456913	external
https://www.cve.org/CVERecord?id=CVE-2025-62718	external
https://nvd.nist.gov/vuln/detail/CVE-2025-62718	external
https://datatracker.ietf.org/doc/html/rfc1034#sec…	external
https://datatracker.ietf.org/doc/html/rfc3986#sec…	external
https://github.com/axios/axios/commit/fb3befb6daa…	external
https://github.com/axios/axios/pull/10661	external
https://github.com/axios/axios/releases/tag/v1.15.0	external
https://github.com/axios/axios/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2025-69873	self
https://bugzilla.redhat.com/show_bug.cgi?id=2439070	external
https://www.cve.org/CVERecord?id=CVE-2025-69873	external
https://nvd.nist.gov/vuln/detail/CVE-2025-69873	external
https://github.com/EthanKim88/ethan-cve-disclosur…	external
https://access.redhat.com/security/cve/CVE-2026-4800	self
https://bugzilla.redhat.com/show_bug.cgi?id=2453496	external
https://www.cve.org/CVERecord?id=CVE-2026-4800	external
https://nvd.nist.gov/vuln/detail/CVE-2026-4800	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/advisories/GHSA-35jh-r3h4-6jhm	external
https://github.com/lodash/lodash/commit/3469357cf…	external
https://access.redhat.com/security/cve/CVE-2026-25679	self
https://bugzilla.redhat.com/show_bug.cgi?id=2445356	external
https://www.cve.org/CVERecord?id=CVE-2026-25679	external
https://nvd.nist.gov/vuln/detail/CVE-2026-25679	external
https://go.dev/cl/752180	external
https://go.dev/issue/77578	external
https://groups.google.com/g/golang-announce/c/Edh…	external
https://pkg.go.dev/vuln/GO-2026-4601	external
https://access.redhat.com/security/cve/CVE-2026-32280	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456339	external
https://www.cve.org/CVERecord?id=CVE-2026-32280	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32280	external
https://go.dev/cl/758320	external
https://go.dev/issue/78282	external
https://groups.google.com/g/golang-announce/c/0uY…	external
https://pkg.go.dev/vuln/GO-2026-4947	external
https://access.redhat.com/security/cve/CVE-2026-32282	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456336	external
https://www.cve.org/CVERecord?id=CVE-2026-32282	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32282	external
https://go.dev/cl/763761	external
https://go.dev/issue/78293	external
https://pkg.go.dev/vuln/GO-2026-4864	external
https://access.redhat.com/security/cve/CVE-2026-40175	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457432	external
https://www.cve.org/CVERecord?id=CVE-2026-40175	external
https://nvd.nist.gov/vuln/detail/CVE-2026-40175	external
https://github.com/axios/axios/commit/363185461b9…	external
https://github.com/axios/axios/pull/10660	external
https://github.com/axios/axios/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-40895	self
https://bugzilla.redhat.com/show_bug.cgi?id=2460297	external
https://www.cve.org/CVERecord?id=CVE-2026-40895	external
https://nvd.nist.gov/vuln/detail/CVE-2026-40895	external
https://github.com/follow-redirects/follow-redire…	external
https://access.redhat.com/security/cve/CVE-2026-42033	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461607	external
https://www.cve.org/CVERecord?id=CVE-2026-42033	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42033	external
https://github.com/axios/axios/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42035	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461606	external
https://www.cve.org/CVERecord?id=CVE-2026-42035	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42035	external
https://github.com/axios/axios/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42039	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461630	external
https://www.cve.org/CVERecord?id=CVE-2026-42039	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42039	external
https://github.com/axios/axios/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42041	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461629	external
https://www.cve.org/CVERecord?id=CVE-2026-42041	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42041	external
https://github.com/axios/axios/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42043	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461626	external
https://www.cve.org/CVERecord?id=CVE-2026-42043	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42043	external
https://github.com/axios/axios/security/advisorie…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Network Observability 1.11 for Red Hat OpenShift.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Network flows collector and monitoring solution.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:16874",
        "url": "https://access.redhat.com/errata/RHSA-2026:16874"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
        "url": "https://access.redhat.com/security/cve/CVE-2025-62718"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69873",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69873"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40175"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40895",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40895"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42033",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42033"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42035",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42035"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42039",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42039"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42041",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42041"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42043",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42043"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4800"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.openshift.com/container-platform/latest/observability/network_observability/network-observability-operator-release-notes.html",
        "url": "https://docs.openshift.com/container-platform/latest/observability/network_observability/network-observability-operator-release-notes.html"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16874.json"
      }
    ],
    "title": "Red Hat Security Advisory: Network Observability 1.11.2 for OpenShift",
    "tracking": {
      "current_release_date": "2026-05-15T21:06:36+00:00",
      "generator": {
        "date": "2026-05-15T21:06:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2026:16874",
      "initial_release_date": "2026-05-13T07:11:01+00:00",
      "revision_history": [
        {
          "date": "2026-05-13T07:11:01+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-13T07:11:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-15T21:06:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Network Observability (NETOBSERV) 1.11.2",
                "product": {
                  "name": "Network Observability (NETOBSERV) 1.11.2",
                  "product_id": "Network Observability (NETOBSERV) 1.11.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:network_observ_optr:1.11::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Network Observability (NETOBSERV)"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3A5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508248"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3A43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778515762"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-cli-rhel9@sha256%3A3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508501"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3Ad61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508956"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3Ae9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-operator-bundle@sha256%3A1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778517101"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-rhel9-operator@sha256%3Aa59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4?arch=amd64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510615"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3Ae0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508248"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3A0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778515762"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-cli-rhel9@sha256%3A34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508501"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3A036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508956"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3A12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
                  "product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-rhel9-operator@sha256%3A79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6?arch=arm64\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510615"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
                  "product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3A59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508248"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
                  "product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3A7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778515762"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
                  "product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-cli-rhel9@sha256%3A37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508501"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3A693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508956"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3Af60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
                  "product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-rhel9-operator@sha256%3A1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5?arch=ppc64le\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510615"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
                  "product_id": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-flowlogs-pipeline-rhel9@sha256%3A376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508248"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
                  "product_id": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-ebpf-agent-rhel9@sha256%3Acc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778515762"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
                  "product_id": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-cli-rhel9@sha256%3Acb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508501"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-compat-rhel9@sha256%3A2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778508956"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
                  "product_id": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-console-plugin-rhel9@sha256%3A3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x",
                "product": {
                  "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x",
                  "product_id": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/network-observability-rhel9-operator@sha256%3Aace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734?arch=s390x\u0026repository_url=registry.redhat.io/network-observability\u0026tag=1778510615"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64 as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x as a component of Network Observability (NETOBSERV) 1.11.2",
          "product_id": "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        },
        "product_reference": "registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x",
        "relates_to_product_reference": "Network Observability (NETOBSERV) 1.11.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-62718",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-04-09T15:01:48.111177+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456913"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456913",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
          "url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
          "url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
          "url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/pull/10661",
          "url": "https://github.com/axios/axios/pull/10661"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
          "url": "https://github.com/axios/axios/releases/tag/v1.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
        }
      ],
      "release_date": "2026-04-09T14:31:46.067000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
    },
    {
      "cve": "CVE-2025-69873",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-02-11T19:01:32.953264+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2439070"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ajv: ReDoS via $data reference",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, the $data option must be enabled and the attacker needs to be able to send a payload with a specially crafted regular expression to the application processing the input. A 31-character payload causes approximately 44 seconds of execution, with each additional character doubling the execution time. Therefore, even a small payload can cause an application to become unresponsive and eventually result in a denial of service. Due to this reason, this flaw has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2439070",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439070"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69873"
        },
        {
          "category": "external",
          "summary": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md",
          "url": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"
        }
      ],
      "release_date": "2026-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters.",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ajv: ReDoS via $data reference"
    },
    {
      "cve": "CVE-2026-4800",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-03-31T20:01:21.918257+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453496"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453496",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
          "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
        },
        {
          "category": "external",
          "summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
          "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
        }
      ],
      "release_date": "2026-03-31T19:25:55.987000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-32280",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-08T02:01:19.572351+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758320",
          "url": "https://go.dev/cl/758320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78282",
          "url": "https://go.dev/issue/78282"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4947",
          "url": "https://pkg.go.dev/vuln/GO-2026-4947"
        }
      ],
      "release_date": "2026-04-08T01:06:58.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "cve": "CVE-2026-32282",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-04-08T02:01:12.683211+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763761",
          "url": "https://go.dev/cl/763761"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78293",
          "url": "https://go.dev/issue/78293"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4864",
          "url": "https://pkg.go.dev/vuln/GO-2026-4864"
        }
      ],
      "release_date": "2026-04-08T01:06:55.953000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
    },
    {
      "cve": "CVE-2026-40175",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-10T20:02:10.296601+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Axios library, a promise-based HTTP client, is susceptible to an Important prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.\n\nThe openshift4/ose-monitoring-plugin-rhel9 container image is not vulnerable to this flaw. The affected component is used as a build-time dependency but it\u0027s not shipped in the final product, meaning the flaw is not present thus cannot be exploited in the container deployments.\n\nRegarding openshift4/ose-console for Product stream 4.12 and 4.13, the vulnerable component is present (indirect dependency), but the vulnerability is not exploitable in our case due to the browser runtime, where the required Node.js-specific attack vectors are not available. With this, the impact becomes low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40175"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
          "url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/pull/10660",
          "url": "https://github.com/axios/axios/pull/10660"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
          "url": "https://github.com/axios/axios/releases/tag/v1.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
        }
      ],
      "release_date": "2026-04-10T19:23:52.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
    },
    {
      "cve": "CVE-2026-40895",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2026-04-21T21:02:33.280553+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460297"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect (a redirection to a different domain), custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect target, potentially leading to the unintended disclosure of authentication information to an untrusted third party.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40895"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460297",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460297"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40895",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895"
        },
        {
          "category": "external",
          "summary": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
          "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"
        }
      ],
      "release_date": "2026-04-21T19:59:59.759000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "follow-redirects: follow-redirects: Information disclosure via cross-domain redirects"
    },
    {
      "cve": "CVE-2026-42033",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T18:01:20.937507+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461607"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, an HTTP client library. This vulnerability allows an attacker to exploit a prototype pollution issue if another part of the application has already polluted the Object.prototype. By doing so, the attacker can intercept and modify JSON responses or take control of the HTTP communication. This could lead to unauthorized access to sensitive information like user credentials and request details.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42033"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461607",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461607"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42033",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42033"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
        }
      ],
      "release_date": "2026-04-24T17:36:44.132000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution"
    },
    {
      "cve": "CVE-2026-42035",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T18:01:17.109481+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461606"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a software library for making network requests. A remote attacker can exploit a prototype pollution vulnerability to inject arbitrary HTTP headers into outgoing requests. This occurs when the application\u0027s core object definitions are manipulated, causing Axios to misinterpret data and include attacker-controlled headers in network communications. This could lead to unauthorized actions or data manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42035"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461606",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461606"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42035",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
        }
      ],
      "release_date": "2026-04-24T17:38:07.752000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution"
    },
    {
      "cve": "CVE-2026-42039",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-24T19:01:44.887156+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461630"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461630",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461630"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42039"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
        }
      ],
      "release_date": "2026-04-24T18:01:30.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data"
    },
    {
      "cve": "CVE-2026-42041",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-24T19:01:41.034289+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461629"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to manipulate the `Object.prototype.validateStatus` property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42041"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461629",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461629"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42041",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42041"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
        }
      ],
      "release_date": "2026-04-24T17:55:30.036000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling"
    },
    {
      "cve": "CVE-2026-42043",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-04-24T19:01:22.552379+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461626"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. An attacker who can control the destination address of an Axios request can exploit this vulnerability. By using specific internal network addresses (within the 127.0.0.0/8 range, excluding 127.0.0.1), the attacker can completely bypass the NO_PROXY protection, potentially leading to unauthorized access or information disclosure within the network. This issue is an incomplete fix for a previous vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: NO_PROXY bypass via crafted URL",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
        ],
        "known_not_affected": [
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
          "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461626",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461626"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42043"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
        }
      ],
      "release_date": "2026-04-24T17:54:42.668000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-13T07:11:01+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:16874"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:34419f34d0ae67c8f212caf1ef2676b5d2631857401e9243c3cedfb403a8b0f5_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:37effb6127e21b88a237af6559921fdc75ab412d5ca50091439ee2ddc109d93a_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:3d2ae0071d04ec457752b05fa372decdf1ad4ec7bfd14625184744456d71b150_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:cb26d81b79328a29cfeded49038bfe9248597adc98a8877b6973a9602bf2fac8_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:036bb1885155decf5f9a678951122bab77d612d7a508267554a126fb90e3a384_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:2548b2b664f5d6630cd49ea9a412941eed178e9932d5eabdec7488c336a911b7_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:693c5d89ab3f7b13b72d98bfa78f5632589996f48a95220b6b5202bd9bcd8054_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:d61e2799e52a2d7c00f581dddc26358fcec6df8d9663c72b9d2bc0dea3e550ea_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:12f64cd35aea9a907db0f11f2f0a346b5a39d1cfca8e851e7c5f5d0f4ff8a456_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3a1e2b780939ff380032e94fb2b653f7b738b5a1706b733a9ddedd35f01f65b1_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:e9df7189264996a042194a2a08babad5c703bc0dc69ac6d72e6b8fb4378824f9_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:f60d2d51d7971e140fcd2c73107168631b178f5a7eec07fed30fe958ebb7c360_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:0bea960a5b46eb1204096eb80204d6f4814580a41f65043d3e10e8f982d2ba4a_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:43019d28d2d58f0af12dabcb681fb8c01aff90f8e5e141a72281ed5faf2c1def_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:7b7ee20cafcdb78df63448e63a2ae5e797494f344bc619d27eaa39e47d81b853_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:cc160fbb3939fc99f543af6ce9fcf9d81b6165c2a0cf4f6984c519393c577428_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:376f34874cc5734670e73a0830b5b4b8224ae1e8783986e9a8139eda36d59d7c_s390x",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:59a0cc6beb2d4d1de1a30107ad92f93f7d21706d22c547a9916f6f8021e2931f_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5f30dc8addf11a96c9e7323134e2bcf45872e6d7885656b23c8b9f8428d27495_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:e0f617d537bb574974c138cd72f9f3948cf881b38ea06dbd535889d52a2c9521_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:1144012ab4bb84b1f73804cb44a0f0febf2a30a5f41d5b301b9eccd125aa4c76_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:1a403eeab4784559f7866c8841d04acb62f8668ff729ac1f37e7a46dbce3ffa5_ppc64le",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:79c5750018bc03c8119de664b624c95ee7d30bd14cb712d6ffab73ef3ae221d6_arm64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:a59db5410dea24e7f0d722200a53990c1ec375ddad8567c1c77bada7f14b81d4_amd64",
            "Network Observability (NETOBSERV) 1.11.2:registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:ace6c6f62c97256f64974228f7b88026645e82281c69dda2d3e72ac7ba90e734_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: NO_PROXY bypass via crafted URL"
    }
  ]
}

CVE-2026-42041 (GCVE-0-2026-42041)

Vulnerability from cvelistv5 – Published: 2026-04-24 17:55 – Updated: 2026-04-24 18:32

Title

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.

Severity ?

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-287 - Improper Authentication
CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/axios/axios/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
axios	axios	Affected: >= 1.0.0, < 1.15.1 Affected: < 0.31.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42041",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T18:29:47.107016Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T18:32:58.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.15.1"
            },
            {
              "status": "affected",
              "version": "\u003c 0.31.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript\u0027s in operator \u2014 an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () =\u003e true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T17:55:30.036Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"
        }
      ],
      "source": {
        "advisory": "GHSA-w9j2-pvgh-6h63",
        "discovery": "UNKNOWN"
      },
      "title": "Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42041",
    "datePublished": "2026-04-24T17:55:30.036Z",
    "dateReserved": "2026-04-23T16:05:01.709Z",
    "dateUpdated": "2026-04-24T18:32:58.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40175 (GCVE-0-2026-40175)

Vulnerability from cvelistv5 – Published: 2026-04-10 19:23 – Updated: 2026-05-12 20:43

Title

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.

Severity ?

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

7 references

URL	Tags
https://github.com/axios/axios/security/advisorie…	x_refsource_CONFIRM
https://github.com/axios/axios/pull/10660	x_refsource_MISC
https://github.com/axios/axios/pull/10688	x_refsource_MISC
https://github.com/axios/axios/commit/03cdfc99e8d…	x_refsource_MISC
https://github.com/axios/axios/commit/363185461b9…	x_refsource_MISC
https://github.com/axios/axios/releases/tag/v0.31.0	x_refsource_MISC
https://github.com/axios/axios/releases/tag/v1.15.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
axios	axios	Affected: >= 1.0.0, < 1.15.0 Affected: < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-13T09:32:22.149Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/axios/axios/pull/10660#issuecomment-4224168081"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40175",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T20:43:26.884164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T20:43:40.670Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "gWAP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:09:07.347Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-876049.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.15.0"
            },
            {
              "status": "affected",
              "version": "\u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific \"Gadget\" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T18:45:12.892Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
        },
        {
          "name": "https://github.com/axios/axios/pull/10660",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/pull/10660"
        },
        {
          "name": "https://github.com/axios/axios/pull/10688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/pull/10688"
        },
        {
          "name": "https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c"
        },
        {
          "name": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
        },
        {
          "name": "https://github.com/axios/axios/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/releases/tag/v0.31.0"
        },
        {
          "name": "https://github.com/axios/axios/releases/tag/v1.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/releases/tag/v1.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fvcv-3m26-pcqx",
        "discovery": "UNKNOWN"
      },
      "title": "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40175",
    "datePublished": "2026-04-10T19:23:52.285Z",
    "dateReserved": "2026-04-09T20:59:17.618Z",
    "dateUpdated": "2026-05-12T20:43:40.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25679 (GCVE-0-2026-25679)

Vulnerability from cvelistv5 – Published: 2026-03-06 21:28 – Updated: 2026-03-10 13:37

Title

Incorrect parsing of IPv6 host literals in net/url

Summary

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Assigner

References

4 references

URL	Tags
https://go.dev/cl/752180
https://go.dev/issue/77578
https://groups.google.com/g/golang-announce/c/Edh…
https://pkg.go.dev/vuln/GO-2026-4601

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/url	Affected: 0 , < 1.25.8 (semver) Affected: 1.26.0-0 , < 1.26.1 (semver)

Credits

Masaki Hara (https://github.com/qnighy) of Wantedly

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-25679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T13:36:26.554241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T13:37:02.459Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "parseHost"
            },
            {
              "name": "JoinPath"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseRequestURI"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.UnmarshalBinary"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.1",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Masaki Hara (https://github.com/qnighy) of Wantedly"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T21:28:14.211Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/752180"
        },
        {
          "url": "https://go.dev/issue/77578"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "title": "Incorrect parsing of IPv6 host literals in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-25679",
    "datePublished": "2026-03-06T21:28:14.211Z",
    "dateReserved": "2026-02-05T01:33:41.943Z",
    "dateUpdated": "2026-03-10T13:37:02.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42039 (GCVE-0-2026-42039)

Vulnerability from cvelistv5 – Published: 2026-04-24 18:01 – Updated: 2026-04-24 18:14

Title

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/axios/axios/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
axios	axios	Affected: >= 1.0.0, < 1.15.1 Affected: < 0.31.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42039",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T18:14:11.509943Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T18:14:37.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.15.1"
            },
            {
              "status": "affected",
              "version": "\u003c 0.31.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T18:01:30.775Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"
        }
      ],
      "source": {
        "advisory": "GHSA-62hf-57xw-28j9",
        "discovery": "UNKNOWN"
      },
      "title": "Axios: unbounded recursion in toFormData causes DoS via deeply nested request data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42039",
    "datePublished": "2026-04-24T18:01:30.775Z",
    "dateReserved": "2026-04-23T16:05:01.709Z",
    "dateUpdated": "2026-04-24T18:14:37.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32280 (GCVE-0-2026-32280)

Vulnerability from cvelistv5 – Published: 2026-04-08 01:06 – Updated: 2026-04-08 17:46

Title

Unexpected work during chain building in crypto/x509

Summary

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

References

4 references

URL	Tags
https://go.dev/cl/758320
https://go.dev/issue/78282
https://groups.google.com/g/golang-announce/c/0uY…
https://pkg.go.dev/vuln/GO-2026-4947

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.25.9 (semver) Affected: 1.26.0-0 , < 1.26.2 (semver)

Credits

Jakub Ciolek - https://ciolek.dev

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-32280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T17:46:14.569488Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T17:46:47.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "Certificate.buildChains"
            },
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.2",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek - https://ciolek.dev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T01:06:58.595Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/758320"
        },
        {
          "url": "https://go.dev/issue/78282"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4947"
        }
      ],
      "title": "Unexpected work during chain building in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-32280",
    "datePublished": "2026-04-08T01:06:58.595Z",
    "dateReserved": "2026-03-11T16:38:46.555Z",
    "dateUpdated": "2026-04-08T17:46:47.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40895 (GCVE-0-2026-40895)

Vulnerability from cvelistv5 – Published: 2026-04-21 19:59 – Updated: 2026-04-22 13:31

Title

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Summary

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/follow-redirects/follow-redire…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
follow-redirects	follow-redirects	Affected: < 1.16.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40895",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T13:31:13.035788Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T13:31:34.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "follow-redirects",
          "vendor": "follow-redirects",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "follow-redirects is an open source, drop-in replacement for Node\u0027s `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T19:59:59.759Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"
        }
      ],
      "source": {
        "advisory": "GHSA-r4q5-vmmm-2653",
        "discovery": "UNKNOWN"
      },
      "title": "follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40895",
    "datePublished": "2026-04-21T19:59:59.759Z",
    "dateReserved": "2026-04-15T16:37:22.766Z",
    "dateUpdated": "2026-04-22T13:31:34.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42033 (GCVE-0-2026-42033)

Vulnerability from cvelistv5 – Published: 2026-04-24 17:36 – Updated: 2026-04-25 03:55

Title

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/axios/axios/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
axios	axios	Affected: >= 1.0.0, < 1.15.1 Affected: < 0.31.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42033",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-25T03:55:57.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.15.1"
            },
            {
              "status": "affected",
              "version": "\u003c 0.31.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T17:36:44.132Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"
        }
      ],
      "source": {
        "advisory": "GHSA-pf86-5x62-jrwf",
        "discovery": "UNKNOWN"
      },
      "title": "Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42033",
    "datePublished": "2026-04-24T17:36:44.132Z",
    "dateReserved": "2026-04-23T16:05:01.708Z",
    "dateUpdated": "2026-04-25T03:55:57.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42035 (GCVE-0-2026-42035)

Vulnerability from cvelistv5 – Published: 2026-04-24 17:38 – Updated: 2026-04-25 03:55

Title

Axios: Header Injection via Prototype Pollution

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/axios/axios/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
axios	axios	Affected: >= 1.0.0, < 1.15.1 Affected: < 0.31.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42035",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-25T03:55:59.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.15.1"
            },
            {
              "status": "affected",
              "version": "\u003c 0.31.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself \u2014 any prototype pollution primitive in any dependency in the application\u0027s dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T17:38:07.752Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"
        }
      ],
      "source": {
        "advisory": "GHSA-6chq-wfr3-2hj9",
        "discovery": "UNKNOWN"
      },
      "title": "Axios: Header Injection via Prototype Pollution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42035",
    "datePublished": "2026-04-24T17:38:07.752Z",
    "dateReserved": "2026-04-23T16:05:01.708Z",
    "dateUpdated": "2026-04-25T03:55:59.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32282 (GCVE-0-2026-32282)

Vulnerability from cvelistv5 – Published: 2026-04-08 01:06 – Updated: 2026-04-13 18:20

Title

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Summary

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

Severity ?

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

References

4 references

URL	Tags
https://go.dev/cl/763761
https://go.dev/issue/78293
https://groups.google.com/g/golang-announce/c/0uY…
https://pkg.go.dev/vuln/GO-2026-4864

Impacted products

1 product

Vendor	Product	Version
Go standard library	internal/syscall/unix	Affected: 0 , < 1.25.9 (semver) Affected: 1.26.0-0 , < 1.26.2 (semver)

Credits

Uuganbayar Lkhamsuren (https://github.com/uug4na)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-32282",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T17:47:42.666766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T18:20:56.456Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "internal/syscall/unix",
          "platforms": [
            "linux"
          ],
          "product": "internal/syscall/unix",
          "programRoutines": [
            {
              "name": "Fchmodat"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.2",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Uuganbayar Lkhamsuren (https://github.com/uug4na)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T01:06:55.953Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/763761"
        },
        {
          "url": "https://go.dev/issue/78293"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4864"
        }
      ],
      "title": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-32282",
    "datePublished": "2026-04-08T01:06:55.953Z",
    "dateReserved": "2026-03-11T16:38:46.556Z",
    "dateUpdated": "2026-04-13T18:20:56.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69873 (GCVE-0-2025-69873)

Vulnerability from cvelistv5 – Published: 2026-02-11 00:00 – Updated: 2026-03-03 17:25

Summary

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Severity ?

2.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

mitre

References

6 references

URL	Tags
https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
https://github.com/EthanKim88/ethan-cve-disclosur…
https://github.com/github/advisory-database/pull/6991
https://github.com/ajv-validator/ajv/pull/2588
https://github.com/ajv-validator/ajv/releases/tag…
https://github.com/ajv-validator/ajv/pull/2590

Impacted products

1 product

Vendor	Product	Version
ajv.js	ajv	Affected: 0 , < 6.14.0 (semver) Affected: 7.0.0 , < 8.17.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-69873",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T15:13:03.482882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-03T17:25:31.651Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ajv",
          "vendor": "ajv.js",
          "versions": [
            {
              "lessThan": "6.14.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.17.2",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ajv.js:ajv:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ajv.js:ajv:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.17.2",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-02T20:22:25.698Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6"
        },
        {
          "url": "https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"
        },
        {
          "url": "https://github.com/github/advisory-database/pull/6991"
        },
        {
          "url": "https://github.com/ajv-validator/ajv/pull/2588"
        },
        {
          "url": "https://github.com/ajv-validator/ajv/releases/tag/v6.14.0"
        },
        {
          "url": "https://github.com/ajv-validator/ajv/pull/2590"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-69873",
    "datePublished": "2026-02-11T00:00:00.000Z",
    "dateReserved": "2026-01-09T00:00:00.000Z",
    "dateUpdated": "2026-03-03T17:25:31.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4800 (GCVE-0-2026-4800)

Vulnerability from cvelistv5 – Published: 2026-03-31 19:25 – Updated: 2026-03-31 20:37

Title

lodash vulnerable to Code Injection via `_.template` imports key names

Summary

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function(). Patches: Users should upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

openjs

References

3 references

URL	Tags
https://github.com/advisories/GHSA-35jh-r3h4-6jhm
https://github.com/lodash/lodash/commit/3469357cf…
https://cna.openjsf.org/security-advisories.html

Impacted products

4 products

Vendor	Product	Version
lodash	lodash	Affected: 4.0.0 , < 4.18.0 (semver) Unaffected: 4.18.0 (semver)
lodash	lodash-es	Affected: 4.0.0 , < 4.18.0 (semver) Unaffected: 4.18.0 (semver)
lodash	lodash-amd	Affected: 4.0.0 , < 4.18.0 (semver) Unaffected: 4.18.0 (semver)
lodash	lodash.template	Affected: 4.0.0 , < 4.18.0 (semver) Unaffected: 4.18.0 (semver)

Credits

dolevmiz1 bugbunny-research M0nd0R UlisesGascon falsyvalues jonchurch threalwinky jdalton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4800",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T20:36:55.080392Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T20:37:03.964Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash",
          "product": "lodash",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash-es",
          "product": "lodash-es",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash-amd",
          "product": "lodash-amd",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/lodash.template",
          "product": "lodash.template",
          "vendor": "lodash",
          "versions": [
            {
              "lessThan": "4.18.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "dolevmiz1"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "bugbunny-research"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "M0nd0R"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "falsyvalues"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "jonchurch"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "threalwinky"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "jdalton"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().\n\nPatches:\n\nUsers should upgrade to version 4.18.0.\n\nWorkarounds:\n\nDo not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names."
            }
          ],
          "value": "Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().\n\nPatches:\n\nUsers should upgrade to version 4.18.0.\n\nWorkarounds:\n\nDo not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T19:25:55.987Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
        },
        {
          "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "lodash vulnerable to Code Injection via `_.template` imports key names",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-4800",
    "datePublished": "2026-03-31T19:25:55.987Z",
    "dateReserved": "2026-03-25T09:12:38.355Z",
    "dateUpdated": "2026-03-31T20:37:03.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42043 (GCVE-0-2026-42043)

Vulnerability from cvelistv5 – Published: 2026-04-24 17:54 – Updated: 2026-04-27 13:47

Title

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-183 - Permissive List of Allowed Inputs
CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/axios/axios/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
axios	axios	Affected: >= 1.0.0, < 1.15.1 Affected: < 0.31.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42043",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T13:47:20.443878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T13:47:24.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.15.1"
            },
            {
              "status": "affected",
              "version": "\u003c 0.31.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-183",
              "description": "CWE-183: Permissive List of Allowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T17:54:42.668Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"
        }
      ],
      "source": {
        "advisory": "GHSA-pmwg-cvhr-8vh7",
        "discovery": "UNKNOWN"
      },
      "title": "Axios: Incomplete Fix for CVE-2025-62718 \u2014 NO_PROXY  Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8)  in Axios 1.15.0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42043",
    "datePublished": "2026-04-24T17:54:42.668Z",
    "dateReserved": "2026-04-23T16:05:01.709Z",
    "dateUpdated": "2026-04-27T13:47:24.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-62718 (GCVE-0-2025-62718)

Vulnerability from cvelistv5 – Published: 2026-04-09 14:31 – Updated: 2026-04-16 18:44

Title

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

Severity ?

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CWE

CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

9 references

URL	Tags
https://github.com/axios/axios/security/advisorie…	x_refsource_CONFIRM
https://github.com/axios/axios/pull/10661	x_refsource_MISC
https://github.com/axios/axios/pull/10688	x_refsource_MISC
https://github.com/axios/axios/commit/03cdfc99e8d…	x_refsource_MISC
https://github.com/axios/axios/commit/fb3befb6daa…	x_refsource_MISC
https://datatracker.ietf.org/doc/html/rfc1034#sec…	x_refsource_MISC
https://datatracker.ietf.org/doc/html/rfc3986#sec…	x_refsource_MISC
https://github.com/axios/axios/releases/tag/v0.31.0	x_refsource_MISC
https://github.com/axios/axios/releases/tag/v1.15.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
axios	axios	Affected: >= 1.0.0, < 1.15.0 Affected: < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62718",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T15:02:50.313939Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T16:15:31.322Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.15.0"
            },
            {
              "status": "affected",
              "version": "\u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T18:44:20.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
        },
        {
          "name": "https://github.com/axios/axios/pull/10661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/pull/10661"
        },
        {
          "name": "https://github.com/axios/axios/pull/10688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/pull/10688"
        },
        {
          "name": "https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c"
        },
        {
          "name": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
        },
        {
          "name": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
        },
        {
          "name": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
        },
        {
          "name": "https://github.com/axios/axios/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/releases/tag/v0.31.0"
        },
        {
          "name": "https://github.com/axios/axios/releases/tag/v1.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axios/axios/releases/tag/v1.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3p68-rc4w-qgx5",
        "discovery": "UNKNOWN"
      },
      "title": "Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-62718",
    "datePublished": "2026-04-09T14:31:46.067Z",
    "dateReserved": "2025-10-20T19:41:22.741Z",
    "dateUpdated": "2026-04-16T18:44:20.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:16874

CVE-2026-42041 (GCVE-0-2026-42041)

CVE-2026-40175 (GCVE-0-2026-40175)

CVE-2026-25679 (GCVE-0-2026-25679)

CVE-2026-42039 (GCVE-0-2026-42039)

CVE-2026-32280 (GCVE-0-2026-32280)

CVE-2026-40895 (GCVE-0-2026-40895)

CVE-2026-42033 (GCVE-0-2026-42033)

CVE-2026-42035 (GCVE-0-2026-42035)

CVE-2026-32282 (GCVE-0-2026-32282)

CVE-2025-69873 (GCVE-0-2025-69873)

CVE-2026-4800 (GCVE-0-2026-4800)

CVE-2026-42043 (GCVE-0-2026-42043)

CVE-2025-62718 (GCVE-0-2025-62718)

Tags

Sightings

Nomenclature