{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new release is now available for Red Hat Satellite 6.18 for RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* yggdrasil-worker-forwarder: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* yggdrasil-worker-forwarder: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* yggdrasil-worker-forwarder: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* yggdrasil-worker-forwarder: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)\n\n* yggdrasil-worker-forwarder: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)\n\n* python3.12-pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport (CVE-2026-12701)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:42151",
        "url": "https://access.redhat.com/errata/RHSA-2026:42151"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2445356",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
      },
      {
        "category": "external",
        "summary": "2449833",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
      },
      {
        "category": "external",
        "summary": "2467822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
      },
      {
        "category": "external",
        "summary": "2480756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
      },
      {
        "category": "external",
        "summary": "2484207",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
      },
      {
        "category": "external",
        "summary": "2490703",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490703"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42151.json"
      }
    ],
    "title": "Red Hat Security Advisory: Satellite 6.18.7.1 Async Update",
    "tracking": {
      "current_release_date": "2026-07-22T17:07:31+00:00",
      "generator": {
        "date": "2026-07-22T17:07:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:42151",
      "initial_release_date": "2026-07-20T19:33:17+00:00",
      "revision_history": [
        {
          "date": "2026-07-20T19:33:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-20T19:33:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-22T17:07:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.18 for RHEL 9",
                  "product_id": "9Base-satellite-6.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.18::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.18 for RHEL 9",
                  "product_id": "9Base-satellite-6.18-capsule",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite_capsule:6.18::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.18 for RHEL 9",
                  "product_id": "9Base-satellite-6.18-utils",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite_utils:6.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite 6"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
                "product": {
                  "name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
                  "product_id": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.0.4-1.el9sat?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.src",
                "product": {
                  "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.src",
                  "product_id": "python3.12-pulpcore-0:3.73.30-2.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pulpcore@3.73.30-2.el9pc?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-0:6.18.7.1-1.el9sat.src",
                "product": {
                  "name": "satellite-0:6.18.7.1-1.el9sat.src",
                  "product_id": "satellite-0:6.18.7.1-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite@6.18.7.1-1.el9sat?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
                "product": {
                  "name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
                  "product_id": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.0.4-1.el9sat?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
                "product": {
                  "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
                  "product_id": "python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12-pulpcore@3.73.30-2.el9pc?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
                "product": {
                  "name": "satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
                  "product_id": "satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-capsule@6.18.7.1-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-common-0:6.18.7.1-1.el9sat.noarch",
                "product": {
                  "name": "satellite-common-0:6.18.7.1-1.el9sat.noarch",
                  "product_id": "satellite-common-0:6.18.7.1-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-common@6.18.7.1-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
                "product": {
                  "name": "satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
                  "product_id": "satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-obsolete-packages@6.18.7.1-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-0:6.18.7.1-1.el9sat.noarch",
                "product": {
                  "name": "satellite-0:6.18.7.1-1.el9sat.noarch",
                  "product_id": "satellite-0:6.18.7.1-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite@6.18.7.1-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-cli-0:6.18.7.1-1.el9sat.noarch",
                "product": {
                  "name": "satellite-cli-0:6.18.7.1-1.el9sat.noarch",
                  "product_id": "satellite-cli-0:6.18.7.1-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-cli@6.18.7.1-1.el9sat?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch"
        },
        "product_reference": "python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src"
        },
        "product_reference": "python3.12-pulpcore-0:3.73.30-2.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.18-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.18.7.1-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src"
        },
        "product_reference": "satellite-0:6.18.7.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.18-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-capsule-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-common-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-common-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.18.7.1-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src"
        },
        "product_reference": "satellite-0:6.18.7.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.18-utils"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-cli-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-cli-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18-utils"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch"
        },
        "product_reference": "python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.12-pulpcore-0:3.73.30-2.el9pc.src as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src"
        },
        "product_reference": "python3.12-pulpcore-0:3.73.30-2.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.18.7.1-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src"
        },
        "product_reference": "satellite-0:6.18.7.1-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-cli-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-cli-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-common-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-common-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
        },
        "product_reference": "satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src"
        },
        "product_reference": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64 as a component of Red Hat Satellite 6.18 for RHEL 9",
          "product_id": "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
        },
        "product_reference": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
        "relates_to_product_reference": "9Base-satellite-6.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Martin Brodeur"
          ],
          "organization": "Independent security researcher"
        }
      ],
      "cve": "CVE-2026-12701",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-04-24T02:44:10+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490703"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with \"/\" but fails to block directory traversal sequences such as \"../\" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., \"looking/normal/../../../../etc/shadow\") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because an authenticated administrator can achieve arbitrary file write outside the intended export directory with fully attacker-controlled content. The FilesystemExport API is restricted to admin-level users (in Satellite, authenticated via SSL certificate; in standalone RBAC deployments, admin role only). The Pulp process runs as the \"pulp\" system user (not root), and file permission bits cannot be controlled by the attacker. However, the \"pulp\" user typically has write access to service-critical paths, and attack vectors such as cron.d entries (text-parsed, no exec bit required) or overwriting Pulp configuration remain viable depending on filesystem permissions and SELinux policy. Red Hat Satellite and Red Hat Ansible Automation Hub ship pulpcore and are affected. RHUI is not affected because end users do not have access to Pulp content creation APIs.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src"
        ],
        "known_not_affected": [
          "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12701"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490703",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490703"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12701",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12701"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12701",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12701"
        }
      ],
      "release_date": "2026-07-20T13:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-20T19:33:17+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42151"
        },
        {
          "category": "workaround",
          "details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.\n2. If FilesystemExporters exist in the database, audit them for path traversal sequences (\"../\"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.\n3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.\n4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.\n5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-20T19:33:17+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42151"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-27145",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-02T23:01:08.992540+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/783621",
          "url": "https://go.dev/cl/783621"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79694",
          "url": "https://go.dev/issue/79694"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5037",
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "release_date": "2026-06-02T22:01:36.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-20T19:33:17+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42151"
        },
        {
          "category": "workaround",
          "details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-20T19:33:17+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42151"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "cve": "CVE-2026-33811",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-05-07T20:01:34.913869+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767860",
          "url": "https://go.dev/cl/767860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78803",
          "url": "https://go.dev/issue/78803"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4981",
          "url": "https://pkg.go.dev/vuln/GO-2026-4981"
        }
      ],
      "release_date": "2026-05-07T19:41:19.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-20T19:33:17+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42151"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "cve": "CVE-2026-39821",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-22T16:00:52.844126+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
          "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
        ],
        "known_not_affected": [
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
          "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
          "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
          "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767220",
          "url": "https://go.dev/cl/767220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78760",
          "url": "https://go.dev/issue/78760"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5026",
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "release_date": "2026-05-22T15:01:21.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-20T19:33:17+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42151"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
          "product_ids": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18-capsule:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18-capsule:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-capsule:satellite-capsule-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-capsule:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18-utils:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18-utils:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.noarch",
            "9Base-satellite-6.18:python3.12-pulpcore-0:3.73.30-2.el9pc.src",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-0:6.18.7.1-1.el9sat.src",
            "9Base-satellite-6.18:satellite-cli-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-common-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:satellite-obsolete-packages-0:6.18.7.1-1.el9sat.noarch",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
            "9Base-satellite-6.18:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    }
  ]
}