RHSA-2026:25039

Vulnerability from csaf_redhat - Published: 2026-06-10 09:34 - Updated: 2026-11-07 05:56
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: jaeger: * jaeger-2.19.0-1.hum1 (aarch64, x86_64) * jaeger-2.19.0-1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-42151

A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-256 - Plaintext Storage of a Password
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64 —
Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src —
Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-42154

A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2026-42151
Threats
Impact Important
CVE-2026-44431

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-201 - Insertion of Sensitive Information Into Sent Data
Affected products
Fixed 3 products, the same list as for CVE-2026-42151
Threats
Impact Moderate
CVE-2026-44432

A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 3 products, the same list as for CVE-2026-42151
Threats
Impact Important
CVE-2026-45409

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2026-42151
Threats
Impact Moderate
CVE-2026-48990

A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 3 products, the same list as for CVE-2026-42151
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:25039 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-48990 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2026-44432 external
https://access.redhat.com/security/cve/CVE-2026-44431 external
https://access.redhat.com/security/cve/CVE-2026-42154 external
https://access.redhat.com/security/cve/CVE-2026-42151 external
https://access.redhat.com/security/cve/CVE-2026-45409 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-42151 self
https://bugzilla.redhat.com/show_bug.cgi?id=2466507 external
https://www.cve.org/CVERecord?id=CVE-2026-42151 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42151 external
https://github.com/prometheus/prometheus/pull/18587 external
https://github.com/prometheus/prometheus/pull/18590 external
https://github.com/prometheus/prometheus/releases… external
https://github.com/prometheus/prometheus/releases… external
https://github.com/prometheus/prometheus/security… external
https://access.redhat.com/security/cve/CVE-2026-42154 self
https://bugzilla.redhat.com/show_bug.cgi?id=2466505 external
https://www.cve.org/CVERecord?id=CVE-2026-42154 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42154 external
https://github.com/prometheus/prometheus/pull/18584 external
https://github.com/prometheus/prometheus/pull/18585 external
https://github.com/prometheus/prometheus/security… external
https://access.redhat.com/security/cve/CVE-2026-44431 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477167 external
https://www.cve.org/CVERecord?id=CVE-2026-44431 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44431 external
https://github.com/urllib3/urllib3/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-44432 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477154 external
https://www.cve.org/CVERecord?id=CVE-2026-44432 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44432 external
https://github.com/urllib3/urllib3/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-45409 self
https://bugzilla.redhat.com/show_bug.cgi?id=2485616 external
https://www.cve.org/CVERecord?id=CVE-2026-45409 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45409 external
https://github.com/kjd/idna/security/advisories/G… external
https://access.redhat.com/security/cve/CVE-2026-48990 self
https://bugzilla.redhat.com/show_bug.cgi?id=2490168 external
https://www.cve.org/CVERecord?id=CVE-2026-48990 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48990 external
https://github.com/authlib/joserfc/releases/tag/1.6.7 external
https://github.com/authlib/joserfc/security/advis… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\njaeger:\n  * jaeger-2.19.0-1.hum1 (aarch64, x86_64)\n  * jaeger-2.19.0-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:25039",
        "url": "https://access.redhat.com/errata/RHSA-2026:25039"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48990",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48990"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42154"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42151"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45409",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45409"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25039.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-07T05:56:29+00:00",
      "generator": {
        "date": "2026-11-07T05:56:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:25039",
      "initial_release_date": "2026-06-10T09:34:54+00:00",
      "revision_history": [
        {
          "date": "2026-06-10T09:34:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T05:56:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jaeger-0:2.19.0-1.hum1@aarch64",
                "product": {
                  "name": "jaeger-0:2.19.0-1.hum1@aarch64",
                  "product_id": "jaeger-0:2.19.0-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jaeger@2.19.0-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jaeger-0:2.19.0-1.hum1@src",
                "product": {
                  "name": "jaeger-0:2.19.0-1.hum1@src",
                  "product_id": "jaeger-0:2.19.0-1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jaeger@2.19.0-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jaeger-0:2.19.0-1.hum1@x86_64",
                "product": {
                  "name": "jaeger-0:2.19.0-1.hum1@x86_64",
                  "product_id": "jaeger-0:2.19.0-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jaeger@2.19.0-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jaeger-0:2.19.0-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64"
        },
        "product_reference": "jaeger-0:2.19.0-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jaeger-0:2.19.0-1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src"
        },
        "product_reference": "jaeger-0:2.19.0-1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jaeger-0:2.19.0-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
        },
        "product_reference": "jaeger-0:2.19.0-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42151",
      "cwe": {
        "id": "CWE-256",
        "name": "Plaintext Storage of a Password"
      },
      "discovery_date": "2026-05-04T19:02:26.983660+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466507"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466507",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18587",
          "url": "https://github.com/prometheus/prometheus/pull/18587"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18590",
          "url": "https://github.com/prometheus/prometheus/pull/18590"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
          "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
        }
      ],
      "release_date": "2026-05-04T18:12:16.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T09:34:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25039"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
    },
    {
      "cve": "CVE-2026-42154",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-04T19:02:19.626646+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42154"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18584",
          "url": "https://github.com/prometheus/prometheus/pull/18584"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/pull/18585",
          "url": "https://github.com/prometheus/prometheus/pull/18585"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
          "url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
          "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
        }
      ],
      "release_date": "2026-05-04T18:13:12.340000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T09:34:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25039"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
    },
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T09:34:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25039"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T09:34:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25039"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    },
    {
      "cve": "CVE-2026-45409",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-05T23:01:44.292958+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2485616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library\u0027s encoding function. This could cause the system to consume significant resources, leading to a Denial of Service (DoS), where the affected application becomes unavailable to legitimate users. This issue stems from an incomplete fix for a previously identified vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the python-idna library. This is an incomplete fix for CVE-2024-3651. The idna.encode() function performs contextual validation checks (valid_contexto) before rejecting oversized inputs, allowing specially crafted long payloads to cause excessive CPU consumption and lead to a denial of service. The fix in version 3.14 rejects long inputs early before further processing, and version 3.15 extends this approach to alternate per-label conversion and codec functions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "RHBZ#2485616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409"
        },
        {
          "category": "external",
          "summary": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx",
          "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"
        }
      ],
      "release_date": "2026-06-05T22:06:07.082000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T09:34:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25039"
        },
        {
          "category": "workaround",
          "details": "To mitigate this denial-of-service vulnerability, applications utilizing the `idna` Python library should implement input validation to ensure that domain names do not exceed the standard 253-character length limit before being passed to the `idna.encode()` function. This operational control prevents the processing of excessively long inputs that could lead to resource exhaustion and service unavailability.\n\nApplications that pass user-controlled data directly to `idna.encode()` without validation checks (e.g.: DNS length \u003c 254 chars) are affected.",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-idna: idna: Denial of Service via specially crafted long inputs"
    },
    {
      "cve": "CVE-2026-48990",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-17T22:00:51.839483+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490168"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the joserfc Python library, which implements the JSON Object Signing and Encryption (JOSE) standards and is bundled by several Red Hat managed-service offerings. joserfc fails to apply its configured payload-size limit (JWSRegistry.max_payload_length) when processing RFC 7797 unencoded (b64=false) JSON Web Signature (JWS) payloads, although it does enforce that limit for normal compact and flattened JSON JWS inputs. A remote, unauthenticated attacker who can submit JWS tokens to an application that accepts lower-trust token values can therefore supply a valid b64=false JWS carrying an oversized payload that the application will deserialize, exhausting memory or CPU resources and causing a denial of service. Only availability is impacted; confidentiality and integrity are not affected. Red Hat Product Security rated this flaw Moderate severity (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), consistent with the upstream CVE record. Based on the current affects, products found to be affected include Red Hat Ansible Automation Platform 2.6 and 2.7, Migration Toolkit for Applications 8.1, Hosted OpenShift Clusters, and Red Hat Hardened Images, and fixes for those products are being pursued with the responsible product teams. Other offerings that were evaluated, including Red Hat Satellite and several cloud.redhat.com and Insights components, do not contain the vulnerable code and are therefore not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
          "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48990"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490168",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490168"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48990",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48990"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48990",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48990"
        },
        {
          "category": "external",
          "summary": "https://github.com/authlib/joserfc/releases/tag/1.6.7",
          "url": "https://github.com/authlib/joserfc/releases/tag/1.6.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5",
          "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5"
        }
      ],
      "release_date": "2026-06-17T21:08:10.534000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T09:34:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25039"
        },
        {
          "category": "workaround",
          "details": "The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer.",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@aarch64",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@src",
            "Red Hat Hardened Images:jaeger-0:2.19.0-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.